New
#1
Is "Restore Partition" A Security Hole? Acer Netbook...
friends
I pulled a drive from a previously stolen acer netbook. I'm trying to help my client get back as much data as possible, and also ascertain whatever I can about what the thief, fence, or final receptor of the netbook actually did.
As best I can guess it, the guy must have enabled the Acer recovery partition.
In the rightful owner's possession, the system had only one user account in its life, and that was password protected.
But from what little I have found about the way the Acer factory restore partition works, it does not look at existing user accts at all.
am I right about this?
Secondly - I'd like to take a look at the Windows System logs for the event of the reinstall and other things I can learn. I have this drive slaved to my lab mule Windows 7 Ultimate system, showing up via usb attach as another drive, and I'm taking ownership of what I need. Is there a way to point the Error/Event log applet under the management snap-in to the logs that are stored on that slaved drive? I can put it back in the netbook easily enough but this would save me a bit of work
thx
z