I want to copy files off of a Windows XP computer onto an external Maxtor USB drive without leaving a trace. How can I do this? Is there a piece of software or a an iso image I can use to do this?
Simplicity is key. Choose folders/files, choose destination... copy.
It is quite a delicate situation, a colleague is planning on leaving their job but wants to have another job lined up first. They need their files off of their computer to demonstrate the level of work that they do. It is not against company policy to copy your files off of the network so no problem there, although it would obvious raise unnecessary suspicion copying them all through Windows.
They have auditing enabled by group policy and the user does not have local admin rights, hence my question.
75 Answers
If they are on his local hard drive any bootable CD should allow you to do this. I'd probably do it with an ubuntu live CD. If you wanted to be really paranoid I guess you could dd the whole hard drive without mounting the file system so that it couldn't possibly write anything then mount the dd'ed image on a separate pc to do the copying.
2To expand on Col's response, Ubuntu can be downloaded from the ubuntu.com downloads section. You probably want the 32bit Desktop version, the latest edition. Download the ISO and burn it to a CD.
First, he should make sure he has all the files he wants copied to the local machine (this will simplify things, so that he doesn't have to make ubuntu connect to the network - that would really set off alarm bells). He'd then probably want to disconnect the network cable, for good measure (for the aformentioned reason). Then he can boot his computer with the CD in the drive (ie: put the disk in the computer while it's still on, then restart the computer).
Now it will run Ubuntu in "live" mode, directly from the CD and in the RAM. Press ENTER on the boot screen to load up the system (or wait 30 seconds and it'll do it for you). It won't install unless he goes to the "Install" icon on the desktop later and follows through the wizard - so make sure he doesn't do that.
Once it loads up, he'll be using Ubuntu linux, which is completely separate from the windows on his harddisk. He can go to the "Places" menu (on the top menu bar), go to "Computer", find his local harddisk and browse for his files. He can then plug in his external USB drive, and copy the files to it (there will be an icon for the USB drive on the Desktop).
Once it's finished copying and he's got all he wants, he should go to the "System" menu (again, on the top menu bar), go to "Shut Down" to turn off the computer, and remove the CD when prompted. Then he can unplug his external USB drive, plug his network cable back in, and boot his computer again as per normal. Hehe :D all done!
This is a slightly scary question. Maybe there is a way to get around the auditing controls, but you could still get 'shoulder surfed' by your boss.
It's normally better to simply 'tell' any new employer about your work, after all, if you have boosted your previous firm's code, what's stopping you trying the same trick on your new employer? That's what you should be worried about.
Couple of if statements I'm afraid, but this works.
If there is external access to work email from home, and
if the files are small or there is no real time limit.
Then attach the files wanted to a draft email at work, log into the work webmail solution from home/internet cafe and save them back down from the draft to USB.
Make sure that if the files are large, that the email quota isn't reached and genereates an log elsewhere.
here you have a Windows Live CD with USB support and a program that will create an image file of the entire hard drive or a selected partition (without a trace) in XML format, which is easy to explore/extract.
of course you can copy only files or folders of interest with BartPE, using the integrated A43 file management utility.
tip: WinToFlash will create you a bootable USB flash drive from your BartPE CD
