On Monday 26 January 2004 13:35, Don Calfa wrote:
> I was issued a challenge and didn't realize that all the pieces wouldn'=
t
> be available.
>
> I have a Win2K laptop that I need to investigate what has been removed
> (disgruntled ex-employee).
>
> There is no CD-ROM (I know, Knoppix would've been great) only a floppy
> drive.
>
> Is there a floppy based distro with ntfs drivers that I can use to get
> into this thing with?
>
> If I can, I'd lftp the contents elsewhere then investigate.


     Does the machine have a network adapter or an empty PCMCIA slot wher=
e a=20
network card could be inserted? If so, you could use "g4u" on a boot flop=
py=20
and copy the disk image via the network to another machine. (For the PCMC=
IA=20
path you'll want to check what network cards "g4u" works with.) I think t=
he=20
resultant file is a straight "dd" from sector zero and up, compressed. Wh=
en=20
uncompressed, that image could then be mounted and examined.
     Hmmm, come to think of it this might be an interesting way to build =
a=20
bootable disk image and then write it to a notebook's hard drive. (That's=
=20
another "Gee, I wonder if" added to my ever-lengthening list.)

--=20
Ed Skinner, ed@flat5.net, http://www.flat5.net/