Am 26. Jan, 2004 schw=E4tzte Gary Nichols so:

> On Mon, 2004-01-26 at 13:35, Don Calfa wrote:
> > I have a Win2K laptop that I need to investigate what has been removed
> > (disgruntled ex-employee).
>
> STOP!  Will there be possible legal action against this employee?  If
> so, don't do anything to the laptop yet.  Have it imaged by a
> professional forensics investigator.
>
> If this laptop won't be considered evidence, then proceed.

Contact Ernie @ www.Linux-Forensics.com.

There is a way to make a boot floppy for Knoppix. There's also a way to
get the floppy to then initiate a network boot and run over the network.
Provided those features are in PenguinSleuth it might be the tool you're
looking for.

Ernie lives here in town, so if you do need to contract someone in he might
be available or know someone to recommend. He should be doing a presentatio=
n
for us soon, as well :).

ciao,

der.hans
--=20
#  https://www.LuftHans.com/    http://www.AZOTO.org/
#  ... make it clear I support "Free Software" and not "Open Source",
#  and don't imply I agree that there is such a thing as a
#  "Linux operating system". - rms