Hi,
I just receive a call from company that use WIM images for imaging laptops.
Question is it possible to use those images for forensic investigation. Or
is it possible with some settings in Windows to create forensic WIM image.
I was searching Microsoft web sites and didn't find the answer.
Thanks in advance.
Dejan

I will take a swing at this with you. WIM images are file based so no
un-deleted data would be collected. Forensic images get deleted data slack
space etc its a bit image of every sector on the drive. ( please forgive me
if this info is already known ) I will assume they have a master WIM image
to image to laptop for each new user to use. I would focus on getting a
forensic image of the laptop hard drive itself. Of course you can
investigate the master WIM image. I guess more info is needed to better
understand the dynamics of this job/

http://en.wikipedia.org/wiki/Windows_Imaging_Format

Jim

On Sun, Nov 18, 2012 at 8:08 AM, Dejan Kraljevski <

Thanks for confirming me this one.
They use Deployment Server to make image and then to re image laptops. And
procedure works fine but is not suitable for sector to sector imaging.
 They will need to implement DD imaging.

They are using the deployment server to "image" existing machines or just
to re-load laptops or desktop computers after a virus or malware infection.
I am just trying to get why they need dd images for new image deployments ?

Jim

On Sun, Nov 18, 2012 at 11:11 AM, Dejan Kraljevski <

They will use DD image for forensic cases inside the company.