3 ms·
You can always re-use the hard-drive after you've created an image of it - but the image gives everyone peace of mind if you ever need to recover/investigate so
by optimiz3 10y ago
You can always re-use the hard-drive after you've created an image of it - but the image gives everyone peace of mind if you ever need to recover/investigate something after the hard-drive is wiped.
This way you can also put the image on a flash drive or Blu-Ray so you don't have to keep physical possession of hard drive/data which sounds like it is important.
I believe tcpdump only helps you if the attack is ongoing, since this is after-the-fact, having an image you can analyze later is probably your best bet.
- vonklaus 10y agoyeah that was my thought. I don't have a sata, but I do have a compatible HD with a windows install laying around, so I put as much of her data as I could into the cloud and maxed out a MS OneCloud 5gb for backup, then swapped drives. she couldn't handles the windows 10 upgrade, so I had to swap back, but I was thinking that keeping the drive as a backup/diagnostics would be best bet. Also, I wanted to replace the ram chips incase they persisted malware to them, but I was holding off to see how serious everyone on here thought it was. What is the windows equiv of stuff like: $ tcpdump $ ps aux ect. and the system level process directories like /Library/PrivilegedHelperTools /Library/LaunchDaemons ect. I guess, i'll just take a peak now. It would be worth spending an hour or so if I could know without a reasonable doubt that they did install malware. If I can't find something obvious, I'll still do clean install.
- wiseleo 10y agoDefinitely no need to replace RAM. Reading cold RAM chips is a valid attack, but it doesn't apply in your case. :)