[tlug] Beware e2labels and Knoppix swap

[Jim <jep200404@example.com>]

Scott VanDusen wrote:

> I've taken the cracked server offline ...

Good. 

When you stick the corrupted drive in another machine for 
forensic analysis, beware of e2label causing the wrong 
partitions to be mounted upon booting. 

Red Hat (and derivative) distros are quite vulnerable to this. 
Nevermind corrupted computers, I've seen RH make very stupid 
mounting choices when there is more than one partition with the 
same e2label, because I put two drives with RH on them in the 
same box. 

Knoppix is a bit safer to work with. Be sure to specify noswap 
when booting to ensure that no crumbs of info in the swap 
partition are obliterated.