Guide to Computer Forensics
and Investigations
Fourth Edition
Chapter 4
Data Acquisition
Objectives
• List digital evidence storage formats
• Explain ways to determine the best acquisition
method
• Describe contingency planning for data acquisitions
• Explain how to use acquisition tools
• Explain how to validate data acquisitions
Understanding Storage
Formats for Digital Evidence
Understanding Storage Formats for
Digital Evidence
• Two types of data acquisition
– Static acquisition
• Copying a hard drive from a powered-off system
• Used to be the standard
• Does not alter the data, so it's repeatable
– Live acquisition
• Copying data from a running computer
• Now the preferred type, because of hard disk encryption
• Cannot be repeated exactly—alters the data
• Also, collecting RAM data is becoming more important
– But RAM data has no timestamp, which makes it much
harder to use
Understanding Storage Formats for
Digital Evidence
• Terms used for a file containing evidence data
– Bit-stream copy
– Bit-stream image
– Image
– Mirror
– Sector copy
• They all mean the same thing
Understanding Storage Formats for
Digital Evidence
• Three formats
– Raw format
– Proprietary formats
– Advanced Forensics Format (AFF)
Raw Format
• This is what the Linux dd command makes
• Bit-by-bit copy of the drive to a file
• Advantages
– Fast data transfers
– Can ignore minor data read errors on source drive
– Most computer forensics tools can read raw format
Raw Format
• Disadvantages
– Requires as much storage as original disk or data
– Tools might not collect marginal (bad) sectors
• Low threshold of retry reads on weak media spots
• Commercial tools use more retries than free tools
– Validation check must be stored in a separate file
• Message Digest 5 ( MD5)
• Secure Hash Algorithm ( SHA-1 or newer)
• Cyclic Redundancy Check ( CRC-32)
Proprietary Formats
• Features offered
– Option to compress or not compress image files
– Can split an image into smaller segmented files
• Such as to CDs or DVDs
• With data integrity checks in each segment
– Can integrate metadata into the image file
• Hash data
• Date & time of acquisition
• Investigator name, case name, comments, etc.
Proprietary Formats
• Disadvantages
– Inability to share an image between different tools
– File size limitation for each segmented volume
• Typical segmented file size is 650 MB or 2 GB
• Expert Witness format is the unofficial standard
– Used by EnCase, FTK, X-Ways Forensics, and
SMART
– Can produce compressed or uncompressed files
– File extensions .E01, .E02, .E03, …
Advanced Forensics Format
• Developed by Dr. Simson L. Garfinkel of Basis
Technology Corporation
• Design goals
– Provide compressed or uncompressed image files
– No size restriction for disk-to-image files
– Provide space in the image file or segmented files
for metadata
– Simple design with extensibility
– Open source for multiple platforms and OSs
Advanced Forensics Format
(continued)
• Design goals (continued)
– Internal consistency checks for self-authentication
• File extensions include .afd for segmented image
files and .afm for AFF metadata
• AFF is open source
Determining the Best
Acquisition Method
Determining the Best Acquisition
Method
• Types of acquisitions
– Static acquisitions and live acquisitions
• Four methods
– Bit-stream disk-to-image file
– Bit-stream disk-to-disk
– Logical
– Sparse
Bit-stream disk-to-image file
• Most common method
• Can make more than one copy
• Copies are bit-for-bit replications of the original
drive
• Tools: ProDiscover, EnCase, FTK, SMART,
Sleuth Kit, X-Ways, iLook
Bit-stream disk-to-disk
• Used when disk-to-image copy is not possible
– Because of hardware or software errors or
incompatibilities
– This problem is more common when acquiring older
drives
• Adjusts target disk’s geometry (cylinder, head, and
track configuration) to match the suspect's drive
• Tools: EnCase, SafeBack (MS-DOS), Snap Copy
Logical Acquisition and Sparse
Acquisition
• When your time is limited, and evidence disk is
large
• Logical acquisition captures only specific files of
interest to the case
– Such as Outlook .pst or .ost files
• Sparse acquisition collects only some of the data
Compressing Disk Images
• Lossless compression might compress a
disk image by 50% or more
• But files that are already compressed, like
ZIP files, won’t compress much more
• Use MD5 or SHA-1 hash to verify the image
Tape Backup
• When working with large drives, an alternative is
using tape backup systems
• No limit to size of data acquisition
– Just use many tapes
• But it’s slow
Returning Evidence Drives
• In civil litigation, a discovery order may require you
to return the original disk after imaging it
• If you cannot retain the disk, make sure you make
the correct type of copy (logical or bitstream)
Contingency Planning for
Image Acquisitions
Contingency Planning for Image
Acquisitions
• Create a duplicate copy of your evidence image file
• Make at least two images of digital evidence
– Use different tools or techniques
• Copy host protected area of a disk drive as well
– Consider using a hardware acquisition tool that can
access the drive at the BIOS level
• Be prepared to deal with encrypted drives
– Whole disk encryption feature in Windows Vista
Ultimate and Enterprise editions
Encrypted Hard Drives
• Windows BitLocker
• TrueCrypt
• If the machine is on, a live acquisition will capture
the decrypted hard drive
• Otherwise, you will need the key or passphrase
– The suspect may provide it
Using Acquisition Tools
• Acquisition tools for Windows
– Advantages
• Make acquiring evidence from a suspect drive more
convenient
– Especially when used with hot-swappable devices
– Disadvantages
• Must protect acquired data with a well-tested write-
blocking hardware device
• Tools can’t acquire data from a disk’s host protected
area
Windows Write-Protection with USB
Devices
• USB write-protection feature
– Blocks any writing to USB devices
• Target drive needs to be connected to an internal
PATA (IDE), SATA, or SCSI controller
• Works in Windows XP SP2, Vista, and Win 7
Acquiring Data with a Linux Boot CD
• Linux can read hard drives that are mounted as
read-only
• Windows OSs and newer Linux automatically mount
and access a drive
• Windows will write to the Recycle Bin, and
sometimes to the NTFS Journal, just from booting
up with a hard drive connected
• Linux kernel 2.6 and later write metadata to the
drive, such as mount point configurations for an ext2
or ext3 drive
• All these changes corrupt the evidence
Acquiring Data with a Linux Boot CD
• Forensic Linux Live CDs mount all drives read-only
– Which eliminates the need for a write-blocker
• Using Linux Live CD Distributions
– Forensic Linux Live CDs
• Contain additional utilities
Forensic Linux Live CDs
• Configured not to mount, or to mount as read-only,
any connected storage media
• Well-designed Linux Live CDs for computer
forensics
• Preparing a target drive for acquisition in Linux
– Modern linux distributions can use Microsoft FAT
and NTFS partitions
Acquiring Data with a Linux Boot CD
(continued)
• Preparing a target drive for acquisition in Linux
(continued)
– fdisk command lists, creates, deletes, and verifies
partitions in Linux
– mkfs.msdos command formats a FAT file system
from Linux
• Acquiring data with dd in Linux
– dd (“data dump”) command
• Can read and write from media device and data file
• Creates raw format file that most computer forensics
analysis tools can read
Acquiring data with dd in Linux
• Shortcomings of dd command
– Requires more advanced skills than average user
– Does not compress data
• dd command combined with the split command
– Segments output into separate volumes
• dd command is intended as a data management
tool
– Not designed for forensics acquisitions
Acquiring data with dcfldd in Linux
• dcfldd additional functions
– Specify hex patterns or text for clearing disk space
– Log errors to an output file for analysis and review
– Use several hashing options
– Refer to a status display indicating the progress of
the acquisition in bytes
– Split data acquisitions into segmented volumes with
numeric extensions
– Verify acquired data with original disk or media data
Capturing an Image with ProDiscover
Basic
• Connecting the suspect’s drive to your workstation
– Document the chain of evidence for the drive
– Remove the drive from the suspect’s computer
– Configure the suspect drive’s jumpers as needed
– Connect the suspect drive to a write-blocker device
– Create a storage folder on the target drive
• Using ProDiscover’s Proprietary Acquisition Format
– Image file will be split into segments of 650MB
– Creates image files with an .eve extension, a log file
(.log extension), and a special inventory file (.pds
extension)
Capturing an Image with ProDiscover
Basic (continued)
• Using ProDiscover’s Raw Acquisition Format
– Select the UNIX style dd format in the Image Format
list box
– Raw acquisition saves only the image data and hash
value
Capturing an Image with AccessData
FTK Imager
• Included on AccessData Forensic Toolkit
• View evidence disks and disk-to-image files
• Makes disk-to-image copies of evidence drives
– At logical partition and physical drive level
– Can segment the image file
• Evidence drive must have a hardware write-
blocking device
– Or the USB write-protection Registry feature enabled
• FTK Imager can’t acquire drive’s host protected area
(but ProDiscover can)
Capturing an Image with AccessData
FTK Imager (continued)
• Steps
– Boot to Windows
– Connect evidence disk to a write-blocker
– Connect target disk
– Start FTK Imager
– Create Disk Image
• Use Physical Drive option
Validating Data Acquisitions
Validating Data Acquisitions
• Most critical aspect of computer forensics
• Requires using a hashing algorithm utility
• Validation techniques
– CRC-32, MD5, and SHA-1 to SHA-512
• MD5 has collisions, so it is not perfect, but it’s still
widely used
• SHA-1 has some collisions but it’s better than MD5
Linux Validation Methods
• Validating dd acquired data
– You can use md5sum or sha1sum utilities
– md5sum or sha1sum utilities should be run on all
suspect disks and volumes or segmented volumes
• Validating dcfldd acquired data
– Use the hash option to designate a hashing algorithm of
md5, sha1, sha256, sha384, or sha512
– hashlog option outputs hash results to a text file that can
be stored with the image files
– vf (verify file) option compares the image file to the
original medium
Windows Validation Methods
• Windows has no built-in hashing algorithm tools for
computer forensics
– Third-party utilities can be used
• Commercial computer forensics programs also
have built-in validation features
– Each program has its own validation technique
• Raw format image files don’t contain metadata
– Separate manual validation is recommended for all
raw acquisitions
