Digital Forensics

Lecture 4
Data Acquisition
 Objectives
• List digital evidence storage formats
• Explain ways to determine the best
acquisition method
• Describe contingency planning for data
acquisitions
• Explain how to use acquisition tools
 Objectives (continued)
• Explain how to validate data acquisitions
• Describe RAID acquisition methods
• Explain how to use remote network
acquisition tools
• List other forensic tools available for data
acquisitions
Understanding Storage Formats
for Digital Evidence
• Two types of data acquisition
– Static acquisition
• Copying a hard drive from a powered-off system
• Used to be the standard
• Does not alter the data, so it's repeatable
– Live acquisition
• Copying data from a running computer
• Now the preferred type, because of hard disk encryption
• Cannot be repeated exactly—alters the data
• Also, collecting RAM data is becoming more important
– But RAM data has no timestamp, which makes it much
harder to use
Understanding Storage Formats
for Digital Evidence
• Terms used for a file containing evidence
data
– Bit-stream copy
– Bit-stream image
– Image
– Mirror
– Sector copy
• They all mean the same thing
Understanding Storage Formats
for Digital Evidence
• Three formats
– Raw format
– Proprietary formats
– Advanced Forensics Format (AFF)
 Raw Format
• This is what the Linux dd command
makes
• Bit-by-bit copy of the drive to a file
• Advantages
– Fast data transfers
– Can ignore minor data read errors on source
drive
– Most computer forensics tools can read raw
format
 Raw Format
• Disadvantages
– Requires as much storage as original disk or
data
– Tools might not collect marginal (bad) sectors
• Low threshold of retry reads on weak media spots
• Commercial tools use more retries than free tools
– Validation check must be stored in a
separate file
• Message Digest 5 ( MD5)
• Secure Hash Algorithm ( SHA-1 or newer)
• Cyclic Redundancy Check ( CRC-32)
 Proprietary Formats
• Features offered
– Option to compress or not compress image
files
– Can split an image into smaller segmented
files
• Such as to CDs or DVDs
• With data integrity checks in each segment
– Can integrate metadata into the image file
• Hash data
• Date & time of acquisition
• Investigator name, case name, comments, etc.
 Proprietary Formats
• Disadvantages
– Inability to share an image between different
tools
– File size limitation for each segmented
volume
• Typical segmented file size is 650 MB or 2 GB
• Expert Witness format is the unofficial
standard
– Used by EnCase, FTK, X-Ways Forensics,
and SMART
– Can produce compressed or uncompressed
files
– File extensions .E01, .E02, .E03, …
 Advanced Forensics Format
• Developed by Dr. Simson L. Garfinkel of
Basis Technology Corporation
• Design goals
– Provide compressed or uncompressed
image files
– No size restriction for disk-to-image files
– Provide space in the image file or segmented
files for metadata
– Simple design with extensibility
– Open source for multiple platforms and OSs
 Advanced Forensics Format
(continued)
• Design goals (continued)
– Internal consistency checks for self-
authentication
• File extensions include .afd for segmented
image files and .afm for AFF metadata
• AFF is open source
 Determining the Best
Acquisition Method
• Types of acquisitions
– Static acquisitions and live acquisitions
• Four methods
– Bit-stream disk-to-image file
– Bit-stream disk-to-disk
– Logical
– Sparse
 Bit-stream disk-to-image file

• Most common method

• Can make more than one copy
• Copies are bit-for-bit replications of the
original drive
• Tools: ProDiscover, EnCase, FTK,
SMART, Sleuth Kit, X-Ways, iLook
 Bit-stream disk-to-disk
• Used when disk-to-image copy is not
possible
– Because of hardware or software errors or
incompatibilities
– This problem is more common when
acquiring older drives
• Adjusts target disk’s geometry (cylinder,
head, and track configuration) to match
the suspect's drive
• Tools: EnCase, SafeBack (MS-DOS),
Snap Copy
 Logical Acquisition and Sparse
Acquisition
• When your time is limited, and evidence
disk is large
• Logical acquisition captures only specific
files of interest to the case
– Such as Outlook .pst or .ost files
• Sparse acquisition collects only some of
the data
 Compressing Disk Images
• Lossless compression might compress a disk
image by 50% or more
• But files that are already compressed, like
ZIP files, won’t compress much more
• Use MD5 or SHA-1 hash to verify the image
 Tape Backup
• When working with large drives, an
alternative is using tape backup systems
• No limit to size of data acquisition
– Just use many tapes
• But it’s slow
 Returning Evidence Drives
• In civil litigation, a discovery order may
require you to return the original disk after
imaging it
• If you cannot retain the disk, make sure
you make the correct type of copy (logical
or bitstream)
– Ask your client lawyer or your supervisor what
is required—you usually only have one
chance
Contingency Planning for Image
Acquisitions
• Create a duplicate copy of your evidence image
file
• Make at least two images of digital evidence
– Use different tools or techniques
• Copy host protected area of a disk drive as well
– Consider using a hardware acquisition tool that
can access the drive at the BIOS level
• Be prepared to deal with encrypted drives
– Whole disk encryption feature in Windows
Vista Ultimate and Enterprise editions
 Encrypted Hard Drives
• Windows BitLocker
• TrueCrypt
• If the machine is on, a live acquisition will
capture the decrypted hard drive
• Otherwise, you will need the key or
passphrase
– The suspect may provide it
– There are some exotic attacks
• Cold Boot
• Passware
• Electron microscope
 Using Acquisition Tools
• Acquisition tools for Windows
– Advantages
• Make acquiring evidence from a suspect drive
more convenient
– Especially when used with hot-swappable devices
– Disadvantages
• Must protect acquired data with a well-tested
write-blocking hardware device
• Tools can’t acquire data from a disk’s host
protected area
Windows Write-Protection with
USB Devices
• USB write-protection feature
– Blocks any writing to USB devices
• Target drive needs to be connected to an
internal PATA (IDE), SATA, or SCSI
controller
• Works in Windows XP SP2, Vista, and
Win 7
 Acquiring Data with a Linux
Boot CD
• Linux can read hard drives that are mounted as
read-only
• Windows OSs and newer Linux automatically
mount and access a drive
• Windows will write to the Recycle Bin, and
sometimes to the NTFS Journal, just from
booting up with a hard drive connected
• Linux kernel 2.6 and later write metadata to the
drive, such as mount point configurations for an
ext2 or ext3 drive
• All these changes corrupt the evidence
 Acquiring Data with a Linux
Boot CD
• Forensic Linux Live CDs mount all drives
read-only
– Which eliminates the need for a write-blocker
• Using Linux Live CD Distributions
– Forensic Linux Live CDs
• Contain additional utilities
 Forensic Linux Live CDs
• Configured not to mount, or to mount as
read-only, any connected storage media
• Well-designed Linux Live CDs for
computer forensics
– Helix
– Penguin Sleuth
– FCCU (French interface)
• Preparing a target drive for acquisition in
Linux
– Modern linux distributions can use Microsoft
FAT and NTFS partitions
 Acquiring Data with a Linux
Boot CD (continued)
• Preparing a target drive for acquisition in
Linux (continued)
– fdisk command lists, creates, deletes, and
verifies partitions in Linux
– mkfs.msdos command formats a FAT file
system from Linux
• Acquiring data with dd in Linux
– dd (“data dump”) command
• Can read and write from media device and data
file
• Creates raw format file that most computer
forensics analysis tools can read
Acquiring data with dd in Linux
• Shortcomings of dd command
– Requires more advanced skills than average
user
– Does not compress data
• dd command combined with the split
command
– Segments output into separate volumes
• dd command is intended as a data
management tool
– Not designed for forensics acquisitions
 Capturing an Image with
ProDiscover Basic
• Connecting the suspect’s drive to your workstation
– Document the chain of evidence for the drive
– Remove the drive from the suspect’s computer
– Configure the suspect drive’s jumpers as needed
– Connect the suspect drive to a write-blocker
device
– Create a storage folder on the target drive
• Using ProDiscover’s Proprietary Acquisition Format
– Image file will be split into segments of 650MB
– Creates image files with an .eve extension, a log
file (.log extension), and a special inventory file
(.pds extension)
 Capturing an Image with
ProDiscover Basic (continued)
 Validating Data Acquisitions
• Most critical aspect of computer forensics
• Requires using a hashing algorithm utility
• Validation techniques
– CRC-32, MD5, and SHA-1 to SHA-512
• MD5 has collisions, so it is not perfect, but
it’s still widely used
• SHA-1 has some collisions but it’s better
than MD5
 Linux Validation Methods
• Validating dd acquired data
– You can use md5sum or sha1sum utilities
– md5sum or sha1sum utilities should be run
on all suspect disks and volumes or
segmented volumes
• Validating dcfldd acquired data
– Use the hash option to designate a hashing
algorithm of md5, sha1, sha256, sha384, or
sha512
– hashlog option outputs hash results to a text
file that can be stored with the image files
– vf (verify file) option compares the image file
to the original medium
 Windows Validation Methods
• Windows has no built-in hashing algorithm
tools for computer forensics
– Third-party utilities can be used
• Commercial computer forensics programs
also have built-in validation features
– Each program has its own validation
technique
• Raw format image files don’t contain
metadata
– Separate manual validation is recommended
for all raw acquisitions
 Understanding RAID
• Redundant array of independent
(formerly “inexpensive”) disks (RAID)
– Computer configuration involving two or
more disks
– Originally developed as a data-redundancy
measure
• RAID 0 (Striped)
– Provides rapid access and increased storage
– Lack of redundancy
• RAID 1 (Mirrored)
– Designed for data recovery
– More expensive than RAID 0
 Understanding RAID
(continued)
• RAID 2
– Similar to RAID 1
– Data is written to a disk on a bit level
– Has better data integrity checking than RAID
0
– Slower than RAID 0
• RAID 3
– Uses data striping and dedicated parity
• RAID 4
– Data is written in blocks
Understanding RAID
(continued)
Understanding RAID
(continued)
 Performing RAID Data
Acquisitions
• Size is the biggest concern
– Many RAID systems now have terabytes of
data
 Acquiring RAID Disks
• Concerns
– How much data storage is needed?
– What type of RAID is used?
– Do you have the right acquisition tool?
– Can the tool read a forensically copied RAID
image?
– Can the tool read split data saves of each
RAID disk?
• Older hardware-firmware RAID systems
can be a challenge when you’re making an
image
 Acquiring RAID Disks
• Vendors offering RAID acquisition
functions
– Technologies Pathways ProDiscover
– Guidance Software EnCase
– X-Ways Forensics
– Runtime Software
– R-Tools Technologies
• Occasionally, a RAID system is too large
for a static acquisition
– Retrieve only the data relevant to the
investigation with the sparse or logical
acquisition method
Using Remote Network Acquisition Tools
• You can remotely connect to a suspect
computer via a network connection and
copy data from it
• Remote acquisition tools vary in
configurations and capabilities
• Drawbacks
– LAN’s data transfer speeds and routing table
conflicts could cause problems
– Gaining the permissions needed to access more
secure subnets
– Heavy traffic could cause delays and errors
– Remote access tool could be blocked by
antivirus
 Remote Acquisition with
ProDiscover Investigator
• Preview a suspect’s drive remotely while
it’s in use
• Perform a live acquisition
– Also called a “smear” because data is being
altered
• Encrypt the connection
• Copy the suspect computer’s RAM
• Use the optional stealth mode to hide the
connection
 Remote Connection Security
Features
• Password Protection
• Encrypted communications
• Secure Communication Protocol
• Write Protected Trusted Binaries
• Digital Signatures
Other Remote Acquisition Tools
• R-Tools R-Studio
• WetStone LiveWire
• F-Response
Thank You!