3.1 Acquisition

How to make a forensic copy without changing the original evidence?

Forensic Workflow HIgh Level [the process of working w/ evidence from start to finish]

1. Extract storage media

2. Acquire forensic copy

3. Authenticate with hashes

4. Analyze working copy

5. Report findings

The 3 A’s of Acquisition

Acquire the evidence • Authenticate the copy • Analyze the data

Types of Acquisition

Static = system is off, Live = system is running

Common Acquisition Methods

1. Physical : bit stream disk to image, or disk to disk

2. Logical

What is Bit-stream Disk-to-Image? What are its use cases?

a forensic image file (.E01, .dd) containing a bit-for-bit copy of the source. contains storage at bit level including active, deleted, slack and hidden areas.

Use Case- you need a forensic copy for analysis and long term storage.

What is Bit-stream Disk-to-Disk, what are its use case?

Creates an exact physical clone of the suspect drive onto another drive. (one device into another same device)

Use cases: You need a working duplicate of the drive rather than an image, uncompressed data and can work directly upon being mounted to correct devices

What is a Logical Acquisition? What is its catch? What is its use case?

Copies selected files and folders available through the file system rather than a complete bit-for-bit image.

Fast but limited is its catch.

When only active files and folders are needed, and time/storage is limited

Logical Acquisition vs Physical Acquisition

Logical : active files and folders avail. in file system/

Physical: unallocated space, deleted space remnants, active data.