I work in an educational setting, and part of my job is to do Data Security Investigations when an institutional machine appears to have been compromised. I am required to capture a forensically sound image of the drive, which under certain circumstances, requires me to boot into Kali Linux in forensic mode and do a dd copy by hand. This usually occurs when the drive can't be pulled, and one or two other special circumstances. I now have a Surface Pro 3 from which I have to obtain an image. At first, I couldn't get a menu. But I followed a set of instructions that I found on Spiceworks, and the Grub menu appeared. However, when I select an option, the screen goes blank and hangs. As part of the solution from Spiceworks, they include a script for the Grub menu. A sample entry (and the one that I use) looks like this:
menuentry "Kali Forensics - No Drive or Swap Mount" {
set root=(hd0,1)
linuxefi /live/vmlinuz boot=live noconfig=sudo username=root hostname=kali noswap noautomount
initrdefi /live/initrd.img
}
Am I missing something? Is there an option or a flag that might not be present? My apologies in advance. I'm a little new to Linux.
Thank you
