Guide To Computer Forensics: 6 Edition

GUIDE TO COMPUTER FORENSICS
6TH EDITION
CHAPTER 3
DATA ACQUISITION
VALIDATING DATA ACQUISITIONS
Validating evidence may be Requires using a hashing Validation techniques

the most critical aspect of algorithm utility
computer forensics CRC-32, MD5, and SHA-1 to SHA-512
LINUX VALIDATION METHODS
Validating dd- • You can use md5sum or sha1sum utilities

acquired data • md5sum or sha1sum utilities should be run on all suspect disks and volumes or segmented volumes
Validating
dcfldd • Use the hash option to designate a hashing algorithm of md5, sha1, sha256, sha384, or sha512
• hashlog option outputs hash results to a text file that can be stored with the image files
acquired data • vf (verify file) option compares the image file to the original medium
WINDOWS VALIDATION METHODS
Windows has no built-in hashing algorithm tools for

computer forensics
• Third-party utilities can be used
Commercial computer forensics programs also have

built-in validation features
• Each program has its own validation technique
Raw format image files don’t contain metadata
• Separate manual validation is recommended for all raw acquisitions

PERFORMING RAID DATA ACQUISITIONS
 Acquisition of RAID drives can be challenging and frustrating

because of how RAID systems are
 Designed
 Configured
 Sized
 Size is the biggest concern

 Many RAID systems now have exabytes of data (1EB = GB)
UNDERSTANDING RAID (1 OF 7)
• Computer configuration involving two or
Redundant array of more disks
independent disks • Originally developed as a data-redundancy
(RAID)
measure
• Provides rapid access and increased
storage
RAID 0 • Biggest disadvantage is lack of
redundancy
• Designed for data recovery
RAID 1 • More expensive than RAID 0
RAID 2 • Similar to RAID 1

• Data is written to a disk on a bit level
• Has better data integrity checking than RAID 0
• Slower than RAID 0
RAID 3 • Uses data stripping and dedicated parity

• Requires at least three disks
RAID 4 • Similar to RAID 3

• Data is written in blocks
 RAID 5
 Similar to RAIDs 0 and 3
 Places parity recovery data on each disk
 RAID 6
 Redundant parity on each disk
 RAID 10 (1+0), or mirrored striping
 Combination of RAID 1 and RAID 0
 Provides fast access and redundancy
 RAID 15 (1+5)
 Combination of RAID 1 and RAID 5
 More costly option
ACQUIRING RAID DISKS (1 OF 2)
Address the following concerns:
• How much data storage is needed?

• What type of RAID is used?
• Do you need to have all drives connected?
• Do you have the right acquisition tool?
• Can the tool read a forensically copied RAID image?
• Can the tool read split data saves of each RAID disk?
Copying small RAID systems to one large disk is

possible
ACQUIRING RAID DISKS (2 OF 2)
 Vendors offering RAID acquisition functions

 Guidance Software EnCase
 X-Ways Forensics
 AccessData FTK
 Runtime Software
 R-Tools Technologies
 Occasionally, a RAID system is too large for a static acquisition

 Retrieve only the data relevant to the investigation with the sparse or
logical acquisition method
USING REMOTE NETWORK ACQUISITION TOOLS
You can remotely connect to a Remote acquisition tools vary in Drawbacks

suspect computer via a network configurations and capabilities
connection and copy data from
it Antivirus, antispyware, and firewall tools can
be configured to ignore remote access
programs
Suspects could easily install their own security
tools that trigger an alarm to notify them of
remote access intrusions
 ProDiscover Incident Response functions:
REMOTE  Capture volatile system state information
ACQUISITION  Analyze current running processes

 Locate unseen files and processes
WITH  Remotely view and listen to IP ports
PRODISCOVER  Run hash comparisons
(1 OF 3)  Create a hash inventory of all files remotely

REMOTE ACQUISITION WITH PRODISCOVER (2 OF 3)
• PDServer remote agent

• ProDiscover utility for remote access
• Needs to be loaded on the suspect
• PDServer installation modes
• Trusted CD
• Preinstallation
• Pushing out and running remotely
• PDServer can run in a stealth mode
• Can change process name to appear as OS function
REMOTE ACQUISITION WITH PRODISCOVER (3 OF 3)
 Remote connection security features

 Password protection
 Encryption
 Secure communication protocol
 Write-protected trusted binaries
 Digital signatures
REMOTE ACQUISITION WITH ENCASE ENTERPRISE
 Remote acquisition features

 Search and collect internal and external
network systems over a wide geographical
area
 Support multiple Oss and file systems
 Triage to help determine system’s
relevance to an investigation
 Perform simultaneous searches of up to
five systems at a time
REMOTE ACQUISITION WITH R-TOOLS R-STUDIO
R-TOOLS SUITE OF CAN REMOTELY CREATES RAW FORMAT SUPPORTS VARIOUS

SOFTWARE IS ACCESS NETWORKED ACQUISITIONS FILE SYSTEMS
DESIGNED FOR DATA COMPUTER SYSTEMS
RECOVERY
REMOTE ACQUISITION WITH WETSTONE US-LATT PRO
 US-LATT PRO
 Part of a suite of tools developed by WetStone
 Can connect to a networked computer remotely and perform a live acquisition of all drives
connected to it
REMOTE ACQUISITION WITH F-RESPONSE
F-Response
• A vendor-neutral remote access utility

• Designed to work with any digital forensics program
• Sets up a security read-only connection
• Allows forensics examiners to access it
Four different version of F-Response
• Enterprise Edition, Consultant + Convert Edition, Consultant Edition,

and TACTICAL Edition
USING OTHER
FORENSICS-
ACQUISITION TOOLS
 Other commercial
acquisition tools
 PassMark Software
ImageUSB
 ASRData SMART
 Runtime Software
 ILookIX Investigator
IXimager
 SourceForge
PASSMARK SOFTWARE IMAGEUSB
 PassMark Software has an acquisition tool called ImageUSB for its OSForensics analysis
product
 To create a bootable flash drive, you need:
 Windows XP or later
 ImageUSB downloaded from the OSForensics Web site
ASR DATA SMART
ASR Data • A Linux forensics analysis tool that can make image files of a
suspect drive
SMART
• Can produce proprietary or raw format images
Capabiliti
• Data reading of bad sectors
• Can mount drives in write-protected mode
• Can mount target drives in read/write mode
es: • Compression schemes to speed up acquisition or reduce amount

of storage needed
RUNTIME SOFTWARE
 Runtime Software offers shareware programs for data acquisition and recovery:
 DiskExplorer for FAT and NTFS
 Features:
 Create a raw format image file
 Segment the raw format or compressed image for archiving purposes
 Access network computers’ drives
ILOOK INVESTIGATOR IXIMAGER
 IXimager
 Runs from a bootable floppy or CD
 Designed to work only with ILookIX
 Can acquire single drives and RAID drives
 Supports:
 IDE (PATA)
 SCSI
 USB
 FireWire
SOURCEFORGE
• SourceForge provides several applications for security, analysis, and

investigations
• For a list of current tools, see:
• SourceForge-Tools
• Windows version of dcfldd
• SourceForge-dcfldd
SUMMARY (1 OF 3)
• Forensics data acquisitions are stored in three different formats:

• Raw, proprietary, and AFF
• Data acquisition methods
• Disk-to-image file
• Disk-to-disk copy
• Logical disk-to-disk or disk-to-data file
• Sparse data copy
SUMMARY (2 OF 3)
 Several tools available

 Lossless compression is acceptable
 Plan your digital evidence contingencies

 Make a copy of each acquisition
 Write-blocking devices or utilities must be used with GUI acquisition tools

 Always validate acquisition
 A Linux Live CD, such as SIFT, Kali Linux, or Deft, provides many useful tools for digital
forensics acquisitions
SUMMARY (3 OF 3)
 Preferred Linux acquisition tool is dcfldd (not dd)

 Use a physical write-blocker device for acquisitions
 To acquire RAID disks, determine the type of RAID
 And then which acquisition tool to use
 Remote network acquisition tools require installing a remote agent

on the suspect computer

Guide To Computer Forensics: 6 Edition

Uploaded by

Copyright:

Available Formats

Guide To Computer Forensics: 6 Edition

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Guide To Computer Forensics: 6 Edition

Uploaded by

Copyright:

Available Formats

GUIDE TO COMPUTER FORENSICS

Validating evidence may be Requires using a hashing Validation techniques

Validating dd- • You can use md5sum or sha1sum utilities

Windows has no built-in hashing algorithm tools for

Commercial computer forensics programs also have

Raw format image files don’t contain metadata

• Separate manual validation is recommended for all raw acquisitions

 Acquisition of RAID drives can be challenging and frustrating

 Size is the biggest concern

RAID 2 • Similar to RAID 1

RAID 3 • Uses data stripping and dedicated parity

RAID 4 • Similar to RAID 3

Address the following concerns:

• How much data storage is needed?

Copying small RAID systems to one large disk is

 Vendors offering RAID acquisition functions

 Occasionally, a RAID system is too large for a static acquisition

You can remotely connect to a Remote acquisition tools vary in Drawbacks

ACQUISITION  Analyze current running processes

PRODISCOVER  Run hash comparisons

(1 OF 3)  Create a hash inventory of all files remotely

• PDServer remote agent

 Remote connection security features

 Remote acquisition features

R-TOOLS SUITE OF CAN REMOTELY CREATES RAW FORMAT SUPPORTS VARIOUS

• A vendor-neutral remote access utility

Four different version of F-Response

• Enterprise Edition, Consultant + Convert Edition, Consultant Edition,

es: • Compression schemes to speed up acquisition or reduce amount

• SourceForge provides several applications for security, analysis, and

• Forensics data acquisitions are stored in three different formats:

 Several tools available

 Plan your digital evidence contingencies

 Write-blocking devices or utilities must be used with GUI acquisition tools

 Preferred Linux acquisition tool is dcfldd (not dd)

 Remote network acquisition tools require installing a remote agent

You might also like