I am the CEO of Fantasy Land

There's been a dearth of posts of late due to the latest addition to the household - the 9 pound, 10 ounce kind that is. . .

Between Kid V.2.0 and l337 h4x04s, I haven't had much time to post, but rynhere breezed by with a few comments. I've edited them for brevity's sake, but since he keeps coming back for the answer, I figured I'd turn this into a post (being the CEO of Fantasy Land does have it's privileges).

rynhere: "why would anyone. . . [grab a password from memory] from a running and logged in computer?"

Bill: Well, I thought it was kind of obvious, but I've found it useful to have passwords ;-).

rynhere: Um, I'm sorry but [PGP ensures] that lost laptops (which are presumably turned off) do not pose a threat as the data is encrypted.

Bill: I agree that PGP does mitigate the risk of data loss, but that was not the point.

rynhere: Is this "defeat" intended to describe how you would take a turned off laptop and defeat the password?

Bill: No.

rynhere: I didn't see any mention of it beyond the obvious of brute force...good luck on that.

Bill: Actually, there are several products out there that will do just that Accessdata's PRTK and DNA come to mind.

rynhere: However, if you have a running computer that has been logged in and is in the windows interface, then let me give you the 1 step method of getting a copy of the data to run forensics against all day long. It's called hooking up a USB drive and downloading the meaningful contents of the native drive.

Bill: Leet!

rynhere: If your trying to obtain forensic information from the box however, as this article seems to illustrate; I'd like to understand how it is that you ask, (in your kindest, big-brother-is-watching sort of way) for this person to log into WDE and the network for you so that you can take their computer for the next 30 minutes to reverse engineer this password. Riiiight. Tell you what, if you can get someone to give you a logged in and running computer, then one of two things is the case,

1. Your the CEO of fantasy land.
2. Your in the wrong profession because you can clearly sell water to a drowning man. Go find your calling in life as a salesperson instead of geeking out on reverse engineering passwords to a running, unencrypted (once you've authenticated to WDE, the drive "appears" as unencrypted) box.

Ok, now to the point. If you are going to image memory over the network, there's a number of ways get the memory. If you have administrative rights on the box, you can use psexec to get a command prompt on the target's computer, then "net use" back to the drive under your control to execute the tools working as the administrator on your target's box. There is no "pretty" way to do a live acquisition, you are going to make some changes no matter what method you choose, but it's nice to have more than one tool in your toolbox.

Oh, and I have asked for and received a number of passwords to computers and I didn't even need to give the users chocolate to get them. You just never know until you ask. . .

That's all your CEO has time for right now. . .