First step in forensics: Create a bootable Windows environment CD

A bootable known-good operating system is an exceptionally handy thing to have around. A corrupted OS could render a computer unusable, and a compromised computer may provide incorrect data, hiding malicious processes or files.

Carrying around a physical hard drive as an alternate boot source is one solution, but it is not very portable and is subject to compromise. A bootable CD (or DVD) is a better choice since it is tamperproof (write only) and much easier to carry. A USB flash drive would also work, but is also susceptible to modification and compromise.

There are dozens of Linux CDs available, many of which are quite useful. Backtrack, a security-oriented CD, is one notable example. However, a bootable Windows environment can be much more useful to someone not familiar with Linux, particularly if that person wants to run tools that only work on Windows. With a bootable Windows disk, you can repair a corrupted registry, examine a computer (which might still alter that computer and wouldn't be forensically sound), and run antivirus from a clean and reliable OS. Creating a Windows disk is quite easy, thanks to the hard work of others. To create th

e disk using the utilities described below, you will require the media and a license for Windows 2000, XP or Server 2003.

There are a few ways to create a bootable Windows CD, the first of which is to use Windows PE. This "Preinstallation Environment" is a minimal installation of Windows. It is an official Microsoft solution, but WindowsPE is often not helpful because of inherent limitations. Microsoft describes it as a "minimal Win32 operating system with limited services built on the Windows Vista kernel."

The next option is BartPE, a tool that will help you create a full installation of Windows that will boot off of a CD or DVD. Despite the name of BartPE, this is not a limited "preinstallation environment" like Windows PE. Practically any software that will run on Windows will run from a BartPE-booted system.

The final option discussed today, and the best for the busy, "just-make-it-work" IT person, is the Ultimate Windows Boot CD. The CD is a collection of Windows tools, based on BartPE, that only require the Windows media to create a bootable Windows disk preloaded with a plethora of handy tools. The tools on the Windows Boot CD include registry editors, file system tools, antivirus software and others.

From a security perspective, this is a great tool to keep on hand, providing a secure bootable Windows environment from which to run AV or to diagnose a system. Also, for the sake of security, you should consider slipstreaming or integrating in the most recent service pack when you create your disk. If, for example, you have a Windows XP disk with SP2, you'd want to slipstream in SP3 to ensure your CD-based OS is as secure and current as reasonably possible.

The Ultimate Boot CD (UBCD) build also provides a handy tool called "Darik's Boot and Nuke," or DBAN, which is a simple-to-use disk erasure tool that can be used when a computer is reassigned or discarded. With a few straightforward steps, this tool will allow you to overwrite the contents of a hard drive. Since neither reinstalling Windows nor reformatting the drive will destroy the prior contents, this is a wise security practice for any reprovisioned or decommissioned hard drive (short of physically destroying the drive). For erasure of the unallocated, or "empty," area of the drive, UBCD includes Eraser. Unlike DBAN, the Windows data removal tool will not destroy everything on a drive, leaving the normal, allocated files alone.

Lastly, since UBCD4WIN includes many useful tools, and it's counterproductive to sort through and learn these when you're in the middle of an IT crisis, I suggest you spend some time looking at these tools before you need them.

A bootable Windows CD is a great tool to keep on hand as it provides a secure environment from which to run antivirus or to examine a system. Such a CD, from an operational IT perspective, is an excellent way to recover and operate on the terminally-ill computers we often have to fix. Now that you have this powerful addition to your toolkit, you'll be even better prepared for the next time a user says, "My computer won't boot, and I need that document NOW!" Good luck!

Tom Chmielarski is a senior consultant with GlassHouse Technologies, Inc.

Send comments on this technical tip to editor@searchmidmarketsecurity.com

Join our IT Knowledge Exchange discussion forum; please use the midmarket security tag.