Guide to Computer Forensics

and Investigations
Fifth Edition

Chapter 3
Data Acquisition
 Objectives

• List digital evidence storage formats

• Explain ways to determine the best acquisition
method
• Describe contingency planning for data acquisitions
• Explain how to use acquisition tools

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 2
 Objectives

• Explain how to validate data acquisitions

• Describe RAID acquisition methods
• Explain how to use remote network acquisition
tools
• List other forensic tools available for data
acquisitions

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 3
 Understanding Storage Formats for
Digital Evidence

• Data in a forensics acquisition tool is stored as an

image file
• Three formats
– Raw format
– Proprietary formats
– Advanced Forensics Format (AFF)

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 4
 Raw Format
• Makes it possible to write bit-stream data to files
• Advantages
– Fast data transfers
– Ignores minor data read errors on source drive
– Most computer forensics tools can read raw format
• Disadvantages
– Requires as much storage as original disk or data
– Tools might not collect marginal (bad) sectors

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 5
 Proprietary Formats

• Most forensics tools have their own formats

• Features offered
– Option to compress or not compress image files
– Can split an image into smaller segmented files
– Can integrate metadata into the image file
• Disadvantages
– Inability to share an image between different tools
– File size limitation for each segmented volume
• The Expert Witness format is unofficial standard
Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 6
 Advanced Forensics Format
• Developed by Dr. Simson L. Garfinkel as an open-
source acquisition format
• Design goals
– Provide compressed or uncompressed image files
– No size restriction for disk-to-image files
– Provide space in the image file or segmented files
for metadata
– Simple design with extensibility
– Open source for multiple platforms and OSs

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 7
 Advanced Forensics Format

• Design goals (cont’d)

– Internal consistency checks for self-authentication
• File extensions include .afd for segmented image
files and .afm for AFF metadata
• AFF is open source

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 8
 Determining the Best Acquisition
Method

• Types of acquisitions
– Static acquisitions and live acquisitions
• Four methods of data collection
– Creating a disk-to-image file
– Creating a disk-to-disk
– Creating a logical disk-to-disk or disk-to-data file
– Creating a sparse data copy of a file or folder
• Determining the best method depends on the
circumstances of the investigation
Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 9
 Determining the Best Acquisition
Method
• Creating a disk-to-image file
– Most common method and offers most flexibility
– Can make more than one copy
– Copies are bit-for-bit replications of the original drive
– ProDiscover, EnCase, FTK, SMART, Sleuth Kit, X-
Ways, iLookIX
• Creating a disk-to-disk
– When disk-to-image copy is not possible
– Tools can adjust disk’s geometry configuration
– EnCase, SafeBack, SnapCopy
Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 10
 Determining the Best Acquisition
Method

• Logical acquisition or sparse acquisition

– Can take several hours; use when your time is
limited
– Logical acquisition captures only specific files of
interest to the case
– Sparse acquisition collects fragments of unallocated
(deleted) data
– For large disks
– PST or OST mail files, RAID servers

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 11
 Determining the Best Acquisition
Method

• When making a copy, consider:

– Size of the source disk
• Lossless compression might be useful
• Use digital signatures for verification
– When working with large drives, an alternative is
using tape backup systems
– Whether you can retain the disk

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 12
 Contingency Planning for Image
Acquisitions
• Create a duplicate copy of your evidence image file
• Make at least two images of digital evidence
– Use different tools or techniques
• Copy host protected area of a disk drive as well
– Consider using a hardware acquisition tool that can
access the drive at the BIOS level
• Be prepared to deal with encrypted drives
– Whole disk encryption feature in Windows called
BitLocker makes static acquisitions more difficult
– May require user to provide decryption key
Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 13
 Using Acquisition Tools
• Acquisition tools for Windows
– Advantages
• Make acquiring evidence from a suspect drive more
convenient
– Especially when used with hot-swappable devices
– Disadvantages
• Must protect acquired data with a well-tested write-
blocking hardware device
• Tools can’t acquire data from a disk’s host protected area
• Some countries haven’t accepted the use of write-
blocking devices for data acquisitions

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 14
 Capturing an Image with ProDiscover
Basic
• Connecting the suspect’s drive to your workstation
– Document the chain of evidence for the drive
– Remove the drive from the suspect’s computer
– Configure the suspect drive’s jumpers as needed
– Connect the suspect drive to write-blocker device
– Create a storage folder on the target drive
• Using ProDiscover’s Proprietary Acquisition Format
– Follow the steps starting on page 108 to start
ProDiscover Basic and configure settings for
acquisition

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 15
 Capturing an Image with ProDiscover
Basic
• Using ProDiscover’s Proprietary Acquisition Format
(con’t)
– ProDiscover creates image files with an .eve
extension, a log file (.log extension), and a special
inventory file (.pds extension)
– If the compression option was selected, ProDiscover
uses a .cmp rather than an .eve extension on all
segmented volumes

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 16
 Capturing an Image with ProDiscover
Basic

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 17
 Capturing an Image with ProDiscover
Basic

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 18
 Capturing an Image with ProDiscover
Basic
• Using ProDiscover’s Raw Acquisition Format
– Follow the same steps as for the proprietary format,
but select the “UNIX style dd” format in the Image
Format list box
– Raw acquisition saves only the image data and hash
value
– The raw format creates a log file (.pds extension)
and segmented volume files

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 19
 Capturing an Image with AccessData
FTK Imager Lite
• Included with AccessData Forensic Toolkit
• Designed for viewing evidence disks and disk-to-
image files
• Makes disk-to-image copies of evidence drives
– At logical partition and physical drive level
– Can segment the image file
• Evidence drive must have a hardware write-
blocking device
– Or run from a Live CD, such as Mini-WinFE

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 20
 Capturing an Image with AccessData
FTK Imager Lite

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 21
 Capturing an Image with AccessData
FTK Imager Lite

• FTK Imager can’t acquire a drive’s host protected

area
• Use a write-blocking device and follow these steps
– Boot to Windows
– Connect evidence disk to a write-blocker
– Connect target disk to write-blocker
– Start FTK Imager Lite
– Create Disk Image - use Physical Drive option
– See Figures on the following slides for more steps

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 22
 Capturing an Image with AccessData
FTK Imager Lite

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 23
 Capturing an Image with AccessData
FTK Imager Lite

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 24
 Capturing an Image with AccessData
FTK Imager Lite

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 25
 Capturing an Image with AccessData
FTK Imager Lite

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 26
 Capturing an Image with AccessData
FTK Imager Lite

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 27
 Validating Data Acquisitions

• Validating evidence may be the most critical aspect

of computer forensics
• Requires using a hashing algorithm utility
• Validation techniques
– CRC-32, MD5, and SHA-1 to SHA-512

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 28
 Linux Validation Methods
• Validating dd acquired data
– You can use md5sum or sha1sum utilities
– md5sum or sha1sum utilities should be run on all suspect
disks and volumes or segmented volumes
• Validating dcfldd acquired data
– Use the hash option to designate a hashing algorithm of
md5, sha1, sha256, sha384, or sha512
– hashlog option outputs hash results to a text file that can
be stored with the image files
– vf (verify file) option compares the image file to the
original medium

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 29
 Windows Validation Methods

• Windows has no built-in hashing algorithm tools for

computer forensics
– Third-party utilities can be used
• Commercial computer forensics programs also
have built-in validation features
– Each program has its own validation technique
• Raw format image files don’t contain metadata
– Separate manual validation is recommended for all
raw acquisitions

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 30
 Performing RAID Data Acquisitions
• Acquisition of RAID drives can be challenging and
frustrating because of how RAID systems are
– Designed
– Configured
– Sized
• Size is the biggest concern
– Many RAID systems now have terabytes of data

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 31
 Understanding RAID
• Redundant array of independent (formerly
“inexpensive”) disks (RAID)
– Computer configuration involving two or more disks
– Originally developed as a data-redundancy measure
• RAID 0
– Provides rapid access and increased storage
– Biggest disadvantage is lack of redundancy
• RAID 1
– Designed for data recovery
– More expensive than RAID 0
Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 32
 Understanding RAID

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 33
 Understanding RAID
• RAID 2
– Similar to RAID 1
– Data is written to a disk on a bit level
– Has better data integrity checking than RAID 0
– Slower than RAID 0
• RAID 3
– Uses data stripping and dedicated parity
• RAID 4
– Data is written in blocks

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 34
 Understanding RAID

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 35
 Understanding RAID

• RAID 5
– Similar to RAIDs 0 and 3
– Places parity recovery data on each disk
• RAID 6
– Redundant parity on each disk
• RAID 10, or mirrored striping
– Also known as RAID 1+0
– Combination of RAID 1 and RAID 0

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 36
 Understanding RAID

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 37
 Acquiring RAID Disks

• Address the following concerns

– How much data storage is needed?
– What type of RAID is used?
– Do you have the right acquisition tool?
– Can the tool read a forensically copied RAID image?
– Can the tool read split data saves of each RAID
disk?
• Copying small RAID systems to one large disk is
possible

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 38
 Acquiring RAID Disks
• Vendors offering RAID acquisition functions
– Technology Pathways ProDiscover
– Guidance Software EnCase
– X-Ways Forensics
– AccessData FTK
– Runtime Software
– R-Tools Technologies
• Occasionally, a RAID system is too large for a static
acquisition
– Retrieve only the data relevant to the investigation with the
sparse or logical acquisition method

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 39
 Summary
• Forensics data acquisitions are stored in three
different formats:
– Raw, proprietary, and AFF
• Data acquisition methods
– Disk-to-image file
– Disk-to-disk copy
– Logical disk-to-disk or disk-to-data file
– Sparse data copy

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 40
 Summary
• Several tools available
– Lossless compression is acceptable
• Plan your digital evidence contingencies
– Make a copy of each acquisition
• Write-blocking devices or utilities must be used with
GUI acquisition tools
• Always validate acquisition
• A Linux Live CD, such as SIFT, Kali Linux, or Deft,
provides many useful tools for digital forensics
acquisitions

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 41
 Summary
• Preferred Linux acquisition tool is dcfldd (not dd)
• Use a physical write-blocker device for acquisitions
• To acquire RAID disks, determine the type of RAID
– And then which acquisition tool to use
• Remote network acquisition tools require installing
a remote agent on the suspect computer

Guide to Computer Forensics and Investigations Fifth Edition © Cengage Learning 2015 42