3 ms·
Or you know, just copy the entire drive while the machine is running....
by mox1 7y ago
Or you know, just copy the entire drive while the machine is running....
- milankragujevic 7y agoThat would not help you, since the contents on the disk are encrypted. You need to get the key from RAM while the server is turned on AND mirror the disk. Doing just the mirror will not help you.
- mox1 7y agoThe copy uses the OS's system calls to transfer data. Thus it will definitely decrypt. If the OS can function, it can read the decrypted data. An Linux OS with full disk encryption can easily be copied while running as root with a simple rsync. Same with Windows.
- milankragujevic 7y agoYes, but you need access to the OS, which means you need a login exploit AND privilege escalation exploit, or a hardware-based backdoor or to mess with the RAM bus while the computer is on.