Scribd Logo
Upload

Welcome to Scribd!

  • 2 views

    Unit 04

    Uploaded by

    Faraja January
    ww

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Unit 04

    Uploaded by

    Faraja January
    2 views24 pages
    ww

    Original Title

    Unit-04

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    ww

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    2 views24 pages

    Unit 04

    Uploaded by

    Faraja January
    ww

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 24

    Data Acquisition

    ISM09204

    Dr. Nicodemus M. M.
    Data Acquisition

    • Acquire the Data: Gather,


    protect, and preserve the original
    evidence.
    Storage Formats for Digital Forensics

    • The following are used storage formats to preserve and analyze evidence
    obtained from storage devices such as hard disk drives (HDDs), solid-state
    drives (SSDs), USB drives, memory cards, and network-attached storage
    (NAS) devices.
    1. Forensic Disk Image (DD/RAW)
    2. Advanced Forensic Format (AFF)
    3. Expert Witness Compression Format (E01)
    4. Raw Disk Image (IMG)
    5. Virtual Disk Image (VMDK, VHD, VDI)
    6. Partition Image (PFI)
    Storage Formats for Digital Forensics
    Forensic Disk Image (DD/RAW)

    • A bit-by-bit copy of the entire storage device, including all data, le system
    structures, and unallocated space.

    • Preserves the original state of the storage device and allows o ine analysis
    without altering the original evidence.

    • Common le extensions: .dd, .img, .raw


    fi
    ffl
    fi
    Storage Formats for Digital Forensics
    Advanced Forensic Format(AFF)

    • An open-source disk imaging format designed for digital forensics


    investigations.

    • Supports metadata preservation, compression, encryption, and error


    detection.

    • Enables e cient storage and analysis of disk images with large capacities.
    • Common le extensions: .aff, .afm
    ffi
    fi
    Storage Formats for Digital Forensics
    Expert Witness Compression Format (E01)

    • A proprietary disk imaging format developed by Guidance Software (now


    OpenText) for use with EnCase Forensic software.

    • Supports compression, encryption, and segmented images for large storage


    devices.

    • Widely used in law enforcement and corporate investigations.


    • Common le extensions: .e01, .ex01, .evidence
    fi
    Storage Formats for Digital Forensics
    Raw Disk Image (IMG)

    • Similar to a forensic disk image but without metadata preservation or


    compression.

    • Provides a raw, uncompressed copy of the storage device's data.


    • Suitable for basic data recovery and analysis tasks.
    • Common le extensions: .img
    fi
    Storage Formats for Digital Forensics
    Virtual Disk Image(VMDK, VHD, VDI)

    • Disk images of virtual machine (VM) disks, used for analyzing virtualized
    environments.

    • Allows investigators to analyze VMs without a ecting the original


    environment.

    • Compatible with virtualization software such as VMware, VirtualBox, and


    Hyper-V.

    • Common le extensions: .vmdk (VMware), .vhd (Microsoft), .vdi


    (VirtualBox)
    fi
    ff
    Storage Formats for Digital Forensics
    Partition Image (PFI)

    • An image of a speci c partition or logical volume within a storage device.


    • Useful for isolating and analyzing individual partitions without imaging the
    entire disk.

    • Enables targeted analysis of speci c data or le systems within a storage


    device.

    • Common le extensions: .pfi


    fi
    fi
    fi
    fi
    Acquisition Methods

    • Static acquisition and logical acquisition are two common methods used in
    digital forensics for acquiring digital evidence from storage devices.

    • While both methods serve the purpose of collecting data for forensic analysis,
    they di er in their approach and the type of data they capture.
    ff
    Acquisition Methods
    Static Acquisition

    • Also known as physical acquisition or bit-by-bit imaging, involves creating a complete


    and exact copy (forensic image) of the entire storage device, including all data, le
    system structures, and unallocated space.

    • Process
    • During static acquisition, the forensic investigator creates a sector-by-sector copy
    of the storage device using specialized forensic imaging tools.

    • The forensic image captures every bit of data on the storage device, regardless of
    whether it is allocated or deleted.

    • This process preserves the original state of the storage device, ensuring that the
    integrity of the evidence is maintained.

    fi
    Acquisition Methods
    Static Acquisition

    • Advantages
    • Preserves the original state of the storage device, allowing for a
    comprehensive analysis of all data.

    • Enables o ine analysis without altering the original evidence.


    • Captures deleted and hidden data, as well as le system metadata.
    ffl
    fi
    Acquisition Methods
    Static Acquisition

    • Disadvantages
    • Time-consuming process, especially for large storage devices.
    • Requires su cient storage space to store the forensic image.
    • May not be feasible in certain scenarios, such as when the storage device
    is physically damaged or inaccessible.
    ffi
    Acquisition Methods
    Logical Acquisition

    • Logical acquisition involves extracting speci c les, folders, and metadata from a
    storage device at the le system level.

    • Process
    • During logical acquisition, the forensic investigator extracts relevant data from the
    storage device based on prede ned criteria, such as le types, timestamps, or
    user-de ned search parameters.

    • This process does not create a bit-by-bit copy of the entire storage device but
    focuses on extracting speci c data relevant to the investigation.

    • Logical acquisition can be performed using forensic imaging tools or specialized


    software that supports le system analysis.
    fi
    fi
    fi
    fi
    fi
    fi
    fi
    fi
    Acquisition Methods
    Logical Acquisition

    • Advantages
    • Faster and more targeted compared to static acquisition, as it only extracts
    speci c data of interest.

    • Requires less storage space, as it does not capture the entire storage
    device.

    • Useful for scenarios where static acquisition is not feasible or necessary,


    such as when analyzing speci c les or directories.
    fi
    fi
    fi
    Acquisition Methods
    Logical Acquisition

    • Disadvantages
    • May overlook deleted or hidden data that is not explicitly targeted during
    the acquisition process.

    • Limited in scope compared to static acquisition, as it only captures data


    visible at the le system level.

    • Cannot recover data that has been physically overwritten or damaged


    beyond repair.
    fi
    Determining the Best Acquisition Methods

    • Both methods have their advantages and limitations, and the choice between
    them depends on factors such as the nature of the investigation, the type of
    evidence required, and the available resources.
    Contingency Planning for Image Acquisition
    Create Redundant Copies of Evidence Images

    • Ensure redundancy by creating duplicate copies of your evidence image le.


    • Generate at least two images of digital evidence, utilizing di erent tools or
    techniques to mitigate the risk of data corruption or loss.

    ff
    fi
    Contingency Planning for Image Acquisition
    Include Host Protected Area (HPA) in Disk Imaging

    • Copy the host protected area of a disk drive in addition to the standard imaging
    process.

    • A Host Protected Area (HPA) is a section of a hard drive or solid-state drive that
    is not normally visible to an operating system. It is a reserved area for data
    storage outside the normal operating system le system.

    • HPAs are used for several specialized applications, such as storing


    con guration data or saving memory to the device in a location that the
    operating systems cannot change.

    • Consider utilizing a hardware acquisition tool capable of accessing the drive at


    the BIOS level for comprehensive data capture.
    fi
    fi
    Contingency Planning for Image Acquisition
    Prepare for Encrypted Drives

    • Anticipate encountering encrypted drives during the acquisition process.


    • Address the challenge of encrypted drives, such as those employing whole
    disk encryption procedures or tools.
    Validating Data Acquisition

    • Validating data acquisition in digital forensics is crucial to ensure the integrity,


    authenticity, and reliability of the acquired evidence.
    Validating Data Acquisition
    Checksum Veri cation

    • Calculate cryptographic checksums (e.g., MD5, SHA-1, SHA-256) of the


    original source data and the acquired image.

    • Compare the checksums to ensure they match, indicating that the acquired
    image is an exact copy of the original source data.
    fi
    Checksum Verification
    Tools

    • Windows has no built-in hashing


    algorithm tools for computer forensics,
    therefore, third-party utilities can be
    used.

    • Commercial computer forensics


    programs programs also have built-in
    validation features. This includes FTK
    Imager, EnCase Forensic, X-Ways
    Forensics, and Magnet AXIOM.
    Checksum Verification
    Tools

    • Command-Line Hashing Tools


    • Examples include md5sum, sha1sum, sha256sum on Linux/Unix
    systems and Certutil on Windows.

    • Stand-Alone Hashing Tools


    • Examples include HashCalc, HashMyFiles, and QuickHash.
    • File Integrity Veri cation Tools
    • Examples include Tripwire, Open Source Tripwire (OSSEC), and Samhain.
    fi

    You might also like