Re: [Full-Disclosure] Imaging Operating Systems

[Maarten <fulldisc@xxxxxxxxxxxx>]

Mmmm... answered my own question with a bit of googling, sorry...  
But it may be helpful or useful in this thread too, so here goes:

On the receiving host, when first making the image, start this:

netcat -l -p 54321 > diskimage

[ It will start waiting for networkinput. ]

On the machine to be imaged, boot linux from a CD and run 

dd if=/dev/hdXY | netcat <receiving_host> 54321
(where hdXY is your partition to be imaged)

The only problem is that you get no progressbar nor a signal that it's 
finished. So you can monitor the filesize at the receiving end or something.
When apparently finished, press [control-C] on the sender.

Restores are similar (disclaimer: I've NOT YET tried this!). First start the 
listening end (the linux on CD) with
netcat -l 54321 | dd of=/dev/hdXY

Then start sending the image:

cat diskimage | netcat <receiving_host> 54321

Surely not comparable to Ghost, but with no extra effort or cost...

Maarten


On Thursday 27 May 2004 17:29, Maarten wrote:
> On Thursday 27 May 2004 16:09, Nick FitzGerald wrote:
> > Michael Schaefer <mbs@xxxxxxxxxxxxx> wrote:
> > > We are building a Windows test system, to try out tool bars, spy ware,
> > > malware and trojans on.
> > >
> > > Once we learn what we need to know, we obviously want to get rid of the
> > > junk quickly and cleanly.
> > >
> > > I keep hearing suggestions about having a "clean image" to transfer
> > > onto the computer.
> > >
> > > Can anyone send some details?
> >
> > The most common approaches to this are the use of virtual machines
> > (VMWare, Virtual PC, etc) and drive image backups (Ghost, etc).  There
> > are pros and cons to each and common pitfalls and issues to consider
> > carefully when setting this all up...
>
> This is an interesting thread...  But out of curiosity, is it also possible
> to do backup / restores using readily available linux tools?
> I'd like to be able to do something like running dd over a network
> connection, or tar, or whatever other tool.  In that case, a bootable CD is
> all you need. But I'm unsure how to do that...
>
> Maarten

-- 
Yes of course I'm sure it's the red cable. I guarante[^%!/+)F#0c|'NO CARRIER

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html