5.1.4.1.4. Copy contents in RAW. This is the actual suspect

5.1.4.1.4. Copy contents in RAW. This is the actual suspect

5.1.4.1. Manually Acquire File from Disk and Extract to secure

5.1.4.1.4. Copy contents in RAW. This is the actual suspect

5.1.4.1.1. Load Helix or Backtrack from CD-ROM

5.1.4.1.2. Mount /dev/sdb1 partition into Sleuthkit case

5.1.4.1.3. Locate required file and click it for meta analysis.

5.1.4.1.5. Upload to Symantec Support for analysis.

5.1.4.1.6. Upload to ThreatExpert.com for automated analysis.

5.1.4.1.7. Upload to Virustotal.com for AntiVirus vendor comparison.

By Efrain Ortiz