Cyberstudy
PDF p.311 In progress

Disk Image Acquisition

Open PDF at p.311 17 flashcards

Summary

PDF p.311

Disk image acquisition involves obtaining data from nonvolatile storage devices like HDDs, SSDs, USB drives, and optical media. This process can be performed in different states, each with its own implications for evidence integrity and legal acceptability.

In plain words

Supplementary — not from your PDF

Disk imaging copies non-volatile storage (HDD, SSD, USB, memory cards, optical media). A live acquisition captures more and disrupts less, but data keeps changing, may not be accepted in court, and may alert the attacker. A static acquisition by shutting down risks anti-forensics; pulling the plug preserves the disk but may corrupt data. Document everything, ideally on video. Tools include forensic suites, dd and dcfldd (which adds verification).

Detailed explanation

PDF p.311

Nonvolatile Storage

  • Types: HDDs, SSDs, firmware, USB drives, memory cards, optical media (CD, DVD, Blu-ray).
  • Device Acquisition: Includes SSD storage in smartphones or media players.
  • OS Installation: Captures the OS if the boot volume is included.

Device States for Acquisition

  • 1. Live Acquisition
    • Description: Copying data while the host is running.
    • Pros: Captures more evidence, reduces service impact.
    • Cons: Data on disks changes, may not be legally acceptable, may alert threat actors.
  • 2. Static Acquisition by Shutting Down
    • Description: Shutting down the host before acquisition.
    • Risk: Malware may detect shutdown and perform anti-forensics.
  • 3. Static Acquisition by Pulling the Plug
    • Description: Disconnecting power at the wall socket.
    • Pros: Preserves storage devices in a forensically clean state.
    • Cons: Risk of data corruption.

Documentation

  • Importance: Document steps, provide a timeline, and video-record actions to ensure evidence integrity.

Imaging Utilities

  • GUI Tools: Available in forensic suites.
  • Linux Command: dd command for copying input file to output file.
    • Example: dd if=/dev/sda of=/mnt/usbstick/backup.img
  • dcfldd: A fork of dd with additional features like multiple output files and exact match verification.

Important terms

taken from the text above
Device Acquisition
Includes SSD storage in smartphones or media players.
OS Installation
Captures the OS if the boot volume is included.
Live Acquisition
Copying data while the host is running.
Pros
Captures more evidence, reduces service impact.
Cons
Data on disks changes, may not be legally acceptable, may alert threat actors.
Static Acquisition by Shutting Down
Shutting down the host before acquisition.
Static Acquisition by Pulling the Plug
Disconnecting power at the wall socket.
GUI Tools
Available in forensic suites.
Linux Command
dd command for copying input file to output file.
dcfldd
A fork of dd with additional features like multiple output files and exact match verification.

Examples & real-world scenarios

Supplementary — not from your PDF
  • dd copying a whole disk to an image file in your own lab.
  • dcfldd creating an image with hash verification.
  • Video-recording the imaging process.

Scenario

Malware may wipe traces when it detects a shutdown. Investigators decide to pull the plug after capturing memory, accepting some corruption risk to avoid triggering anti-forensics.

Common mistakes

Supplementary — not from your PDF
  • Imaging without documenting each step.
  • Not considering how malware might react to a clean shutdown.

Practical skills

Supplementary — not from your PDF
  • Compare live, shutdown and pull-the-plug acquisition.

What I should remember

Key Points PDF p.311
  • Nonvolatile Storage: HDDs, SSDs, USB drives, optical media.
  • Device States
    • Live Acquisition: Running host, more evidence, potential legal issues.
    • Static Acquisition (Shutdown): Risk of anti-forensics.
    • Static Acquisition (Pull Plug): Forensically clean, risk of corruption.
  • Documentation: Essential for evidence integrity.
  • Imaging Utilities: GUI tools, dd command, dcfldd.