Jump to content

Remove drive and scan on another PC


Recommended Posts

It can scan all of them already without removing the drive. However it is better to have MBAM installed and running in the real environment to do detection and removal.

Yes I do know that but I mean a system that's infected to the point you have to remove the drive to scan it on another PC. Does it scall ALL files?

Link to post
Share on other sites

In theory as long as the user profiles do not have a password it SHOULD work. I don't think we have simulated this in the lab so please do keep us up to date if you end up trying it.

RubberDucky just so you know, I have performed what this user is asking, and I have been able to do a scan the whole drive, but it the profile was set to private, then you can not access the files, but if it had a password on it, you can still see the files. If they are private you would have to take control of the folder. Of course by doing that, if the user had encryption enabled on those folders, they could loose all files that had the encryption.

If you are interested in the exact steps I take, then send me a PM and I will explain in further detail, as doing it here would or could cause problems if someone decided to follow those steps. (I am in the business and know what I am doing so I would know how to recover if something happened).

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.