Introduction to forensic imaging
1 like1,199 views
The document provides an overview of the forensic image acquisition process using Kali Linux, detailing methods such as dcfldd and dc3dd, along with gui tools like Guymager. It explains the importance of acquiring a forensically sound image, including hardware and software write-blocking techniques, and covers different forensic image formats and hard disk geometry. Key features such as Device Configuration Overlay (DCO) and Host Protected Area (HPA) are also discussed, highlighting their relevance to digital forensics.
Introduction to forensic imaging
- 1. Digital forensics with Kali Linux Marco Alamanni Section 2 Acquiring forensic images www.packtpub.com
- 2. In this Section, we are going to take a look at… Introduction to the forensic image acquisition process. Acquiring images with dcfldd and dc3dd. Acquiring images with a GUI tool: Guymager
- 3. Digital forensics with Kali Linux Marco Alamanni Video 2.1 Introduction to forensic imaging
- 4. In this Video, we are going to take a look at… • Introduction to the basic concepts of forensic imaging. • Hardware and software write-blocking techniques. • Forensic image formats. • Hard disks geometry and ATA features: DCO and HPA
- 5. Introduction to forensic imaging • Forensic image acquisition is the process of acquiring a forensically sound copy or image of the device or media to analyze. • Forensically sound means that the we shall be able to verify that the image is an exact copy of the original and the procedure used to acquire it shall be documented. • The image file is the basis on which the examiner works to find the evidence.
- 6. Introduction to forensic imaging • A forensic image is a bit by bit copy of the media to analyze. • It’s not simply cloning the file system, it’s a copy of all the raw disk (or partition) sectors. • The original media must not be altered in any way! • The integrity of the image file shall be verified and I/O errors logged. (see NIST CFTT: Testing Disk Imaging Tools)
- 7. Introduction to forensic imaging • Two scenarios when acquiring a forensic image: the hard drive is removed or not removed from the suspect computer. • In the first case, we use a forensic live cd, like Kali Linux. Forensic live cds shall be booted in forensic mode. • In the second case, we must attach the drive to a forensic workstation using a write blocking mechanism.
- 8. Hardware and software write blocking • Write blocking mechanisms can be implemented in hardware or software. • Hardware write blockers are devices that protect the drive from writes and could have different type of connectors. • Are quite expensive but their use is preferable.
- 10. Software write blocking • Software write blocking is quite a controversial topic. • Simply mounting a drive as read-only doesn’t fully guarantee that it is not written! • Various techniques have been developed.
- 11. Software write blocking • Linux write blocker kernel patch written by M.Suhanov. • It blocks the write commands at the device driver level. • But requires the kernel to be recompiled.
- 12. Forensic image formats • A raw image is a duplicate of all the sectors of a disk or partition. • It contains no additional metadata. • Can be obtained by tools like dd (Data Dump). Variants of dd have been developed for forensics.
- 13. Forensic image formats • Another open forensic format is the Advanced Forensic Format (AFF) (S. Garfinkel). • It supports compression and encryption of images. • AFFlib package to convert and manage AFF images.
- 14. Forensic image formats • Proprietary formats: Expert Witness Format (EWF) and SMART • Both supports compression and encryption of images. • libewf package to convert and manage ewf images.
- 16. Hard disk addressing: CHS and LBA • CHS (Cylinder-Head-Sector) is the traditional physical block addressing scheme. • Outdated but still used. • LBA (Logical Block Addressing) is a linear addressing scheme that replaced CHS addressing. • Sectors are located by a 48 bits integer index.
- 17. Hard disk addressing: CHS and LBA
- 18. Hard disk forensics: DCO and HPA • Two features introduced in the ATA standard that are relevant to digital forensics: DCO (Device configuration overlay) and HPA (Host protected area). • DCO allows to configure reported disk capacity and features. • HPA hides disk areas to the OS and reserves them to store data. • Both features have been abused to hide illicit data.
- 19. Hard disk forensics: DCO and HPA • Both DCO and HPA can be revealed and removed with a command line tool: hdparm. • We are going to show its usage next.
- 20. Summary • Introduction to the basic concepts of forensic imaging. • Hardware and software write-blocking techniques. • Forensic image formats. • Hard disks geometry and ATA features: DCO and HPA
- 21. Next Video Introduction to dcfldd and dc3dd