Radified Community Forums - Help Request: Scriptable Ghost Auto-Installer

Radified Community Forums › Rad Community Technical Discussion Boards (Computer Hardware + PC Software) › PC Hardware + Software (except Cloning programs) › Help Request: Scriptable Ghost Auto-Installer

(Moderators: Rad, Christer, NightOwl, Pleonasm, MrMagoo, El_Pescador)

‹ Previous Topic | Next Topic ›

Pages: 1

Help Request: Scriptable Ghost Auto-Installer (Read 4659 times)

pdblues

Ex Member

Help Request: Scriptable Ghost Auto-Installer
Jun 13^th, 2005 at 10:26pm

Hoping someone has been down this road and can point me in a direction. I have been tasked with creating backups of all our CPUs. I am in a police high tech crimes forensic unit and we need a solution to quickly restore our machines after performing an analysis.

I have created images of all our machines with 2003 corporate edition. The owners of this project would like to use our windows based server to have a networked solution where they can pull the images down from the server. Unfortunately, I don't think they will want to run the ghost client on the server. I think I can use GhostCast on the server etc. but that's way more than I wanted to go into. So I've kinda' scrapped the network solution. Am I correct in thinking the Ghost app has to be running on the server in master mode to allow that solution to occur?

If so, I am now trying to find out how I can make it as SIMPLE as possible for the investigators to pop in a CD specific to their machine, restart and walk away. In whatever time they can come back and the machine will be restored. In other words, they don't want to have to do much other than pop the CD in.

I've seen it done with other companies I've worked at where they deploy a single CD to us and it does all the work for you.

Can anyone point me in a direction on this?

Any help is greatly appreciated!!!

IP Logged

NightOwl-

Übermensch

Offline

"I tought I saw a puddy
tat...."

Posts: 2094
Olympia, WA--Puget Sound-USA

Re: Help Request: Scriptable Ghost Auto-Installer
Reply #1 - Jun 14^th, 2005 at 1:50am

pdblues

Interesting...curious--what 'analysis' alters your system such that you need to restore?

Sorry, but I have no 'corporate/network' experience--but I may be able to point you to resources for the individual CD restores--

Will the restore data fit on 1 CD?

Each person's setup varies--so often you have to alter the 'script' to account for your particular set up--i.e. how many partitions you have, how many optical drives you have, what drive letter assignments have be made for each, etc.

So here's some references that may get you going in the right direction:

Ghost 2003 cloning from image on NTFS partition...

See...'Automated Batch File' Section

How To Create A Bootable Ghost Rescue CD Tutorial

Hope this helps...more questions?...share with us the final results of you efforts...i.e. your particular batch file and how it works...

No question is stupid...but, possibly the answers are Wink

!
(This is an old *NightOwl* user account--not in current use. Current account is NightOwl without a dash at the end.)

IP Logged

pdblues

Ex Member

Re: Help Request: Scriptable Ghost Auto-Installer
Reply #2 - Jun 14^th, 2005 at 8:32am

Each time a hard drive is analyzed for a court case, the machine has to be re-imaged or the defense attorney can argue that the data found might have been from another analysis. It's easy to refute because we can show the MD5 code is the same as the hard drive we are examining, but it's easier just to re-image and take the wind out of their sails. Wink

I'll start on the links you provided...thanks.

IP Logged

NightOwl-

Übermensch

Offline

"I tought I saw a puddy
tat...."

Posts: 2094
Olympia, WA--Puget Sound-USA

Re: Help Request: Scriptable Ghost Auto-Installer
Reply #3 - Jun 14^th, 2005 at 11:00am

pdblues

So, is the procedure you're wanting>> the ability to put a 'criminal investigated HDD' on a system and have a clone of that HDD created for analysis--for the defense attorney--keeping the original un-touched?

Does the MD5 of a whole HDD include the boot sector in its calculation?

In Ghost 2003 consumer version, when a HDD is 'seen' by Ghost for the first time, Ghost wants to place an ID code in the boot sector. You get an opening screen when you run Ghost asking if you are willing to have Ghost do that. And there seems no way to by-pass that request screen until you allow Ghost to ID the HDD. You have to manually answer 'Yes' or 'No' to the ID request.

Does the corporate version allow you to by-pass the opening request screen without having to manually respond?

And, if a major Ghost procedure occurs--behind the scene and without asking, Ghost 2003 places what it calls a 'fingerprint' that shows date, procedure, and Ghost version used in that same boot sector region. One can suppress that 'fingerprint' using the '-fnf' command line switch.

One can control the 'fingerprint' issue by using Ghost's 'license file' where certain functions can be 'permanently' changed. See here:

How to customize Ghost for individual users

But, there appears no way in that file to suppress the ID request.

Does the corporate version allow you to suppress that 'fingerprinting'?

The reason for those questions--if MD5 uses the boot sector plus the rest of the HDD data to calculate that MD5 number--then you must be preventing Ghost from making its entries in the boot sector of the HDD copy--else the MD5 numbers would not match.

And, if the corporate version does not suppress the ID function, then that will effect 'how automated' you can be if you need to respond each time to the request to ID the HDD.

No question is stupid...but, possibly the answers are Wink

!
(This is an old *NightOwl* user account--not in current use. Current account is NightOwl without a dash at the end.)

IP Logged

pdblues

Ex Member

Re: Help Request: Scriptable Ghost Auto-Installer
Reply #4 - Jun 14^th, 2005 at 12:04pm

I should have explained myself more clearly. We have a special forensic program that extracts the data from the "suspected" hard drive once it gets seized. The suspect drive is never actually touched, modified, etc. The data extraction program pulls the data in question off the hard drive (be it criminal data records, pornographic material, etc.) and makes a copy of the data in question, and only that data which we specify, to a seperate drive on the forensic computer. There it is prepared for trial (printed, cataloged, etc.)

In order to stop any nonsense at trial, the investigators re-image their entire machine to a base install so nothing exists from previous investigations. It also keeps the machines running smoothly too. It's also SOP-driven so despite the fact that it may be overkill, the bosses want it done.

Those links you posted put me onto a good site where you can create the bootable recovery CD. That looks like it might be a solution.

Thinking about the network options though - I was digging around Symantec's site and found in their knowledge base an article which details the steps necessary to back up to a network mapped drive. I thought I remember reading somewhere about the fact that a copy of ghost had to be running on both the client and the server in order to accomplish this task. The K. Base article mentions nothing about that. Any thoughts?

IP Logged

Rad

Radministrator

Offline

Sufferin' succotash

Posts: 4090
Newport Beach, California

	Re: Help Request: Scriptable Ghost Auto-Installer Reply #5 - Jun 14^th, 2005 at 2:17pm Rob's has lots of scripting info: http://www.robvanderwoude.com/index.html
	IP Logged

Pages: 1

‹ Previous Topic | Next Topic ›

« Home

‹ Board

Top of this page

	Welcome, Guest. Please Login