2.1.5.1. Manually Acquire File from Disk and Extract to secure
2.1.5. Clean Boot Disk Analysis and Extraction with Helix or

2.1.5.1. Manually Acquire File from Disk and Extract to secure

2.1.5.1.1 Load Helix or Backtrack from CD-ROM
2.1.5.1.2. Mount /dev/sdb1 partition into Sleuthkit case
2.1.5.1.3. Locate required file and click it for meta analysis.
2.1.5.1.4. Copy contents in RAW. This is the actual suspect
2.1.5.1.5. Upload to Symantec Support for analysis.
2.1.5.1.6. Upload to ThreatExpert.com for automated analysis.
2.1.5.1.7. Upload to Virustotal.com for AntiVirus vendor comparison.

2.1.5.2. Are known Good Files Excluded

By Efrain Ortiz
 

2.1.5.1. Manually Acquire File from Disk and Extract to secure media

1. Load Helix or Backtrack from CD-ROM 2. Mount /dev/sdb1 partition into Sleuthkit case 3. Locate required file and click it for meta analysis. 4. Copy contents in RAW. This is the actual suspect file. 5. Upload to Symantec Support for analysis. 6. Upload to ThreatExpert.com for automated analysis. 7. Upload to Virustotal.com for AntiVirus vendor comparison.