Disk Image Acquisition
Summary
PDF p.311Disk image acquisition involves obtaining data from nonvolatile storage devices like HDDs, SSDs, USB drives, and optical media. This process can be performed in different states, each with its own implications for evidence integrity and legal acceptability.
In plain words
Supplementary — not from your PDFDisk imaging copies non-volatile storage (HDD, SSD, USB, memory cards, optical media). A live acquisition captures more and disrupts less, but data keeps changing, may not be accepted in court, and may alert the attacker. A static acquisition by shutting down risks anti-forensics; pulling the plug preserves the disk but may corrupt data. Document everything, ideally on video. Tools include forensic suites, dd and dcfldd (which adds verification).
Detailed explanation
PDF p.311Nonvolatile Storage
- Types: HDDs, SSDs, firmware, USB drives, memory cards, optical media (CD, DVD, Blu-ray).
- Device Acquisition: Includes SSD storage in smartphones or media players.
- OS Installation: Captures the OS if the boot volume is included.
Device States for Acquisition
-
1. Live Acquisition
- Description: Copying data while the host is running.
- Pros: Captures more evidence, reduces service impact.
- Cons: Data on disks changes, may not be legally acceptable, may alert threat actors.
-
2. Static Acquisition by Shutting Down
- Description: Shutting down the host before acquisition.
- Risk: Malware may detect shutdown and perform anti-forensics.
-
3. Static Acquisition by Pulling the Plug
- Description: Disconnecting power at the wall socket.
- Pros: Preserves storage devices in a forensically clean state.
- Cons: Risk of data corruption.
Documentation
- Importance: Document steps, provide a timeline, and video-record actions to ensure evidence integrity.
Imaging Utilities
- GUI Tools: Available in forensic suites.
-
Linux Command: dd command for copying input file to output file.
- Example: dd if=/dev/sda of=/mnt/usbstick/backup.img
- dcfldd: A fork of dd with additional features like multiple output files and exact match verification.
Important terms
taken from the text above- Device Acquisition
- Includes SSD storage in smartphones or media players.
- OS Installation
- Captures the OS if the boot volume is included.
- Live Acquisition
- Copying data while the host is running.
- Pros
- Captures more evidence, reduces service impact.
- Cons
- Data on disks changes, may not be legally acceptable, may alert threat actors.
- Static Acquisition by Shutting Down
- Shutting down the host before acquisition.
- Static Acquisition by Pulling the Plug
- Disconnecting power at the wall socket.
- GUI Tools
- Available in forensic suites.
- Linux Command
- dd command for copying input file to output file.
- dcfldd
- A fork of dd with additional features like multiple output files and exact match verification.
Examples & real-world scenarios
Supplementary — not from your PDF- dd copying a whole disk to an image file in your own lab.
- dcfldd creating an image with hash verification.
- Video-recording the imaging process.
Scenario
Malware may wipe traces when it detects a shutdown. Investigators decide to pull the plug after capturing memory, accepting some corruption risk to avoid triggering anti-forensics.
Common mistakes
Supplementary — not from your PDF- Imaging without documenting each step.
- Not considering how malware might react to a clean shutdown.
Practical skills
Supplementary — not from your PDF- Compare live, shutdown and pull-the-plug acquisition.
What I should remember
Key Points PDF p.311- Nonvolatile Storage: HDDs, SSDs, USB drives, optical media.
-
Device States
- Live Acquisition: Running host, more evidence, potential legal issues.
- Static Acquisition (Shutdown): Risk of anti-forensics.
- Static Acquisition (Pull Plug): Forensically clean, risk of corruption.
- Documentation: Essential for evidence integrity.
- Imaging Utilities: GUI tools, dd command, dcfldd.