{[ promptMessage ]}

Bookmark it

{[ promptMessage ]}

Week_6b - Computer Forensics Basics L e c tu r e 9 b E v id...

Info icon This preview shows pages 1–11. Sign up to view the full content.

View Full Document Right Arrow Icon
© 2007 Purdue University Marcus K. Rogers CIT 1 Computer Forensics: Basics Lecture 9b Evidence Acquisition
Image of page 1

Info icon This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document Right Arrow Icon
© 2007 Purdue University Marcus K. Rogers CIT 2 Agenda • Objectives Why use images? Bitstream vs. backups Forensic imaging setup Forensic imaging methods (disk to disk, network) Preserving volatile data Lab: Evidence Acquisition
Image of page 2
© 2007 Purdue University Marcus K. Rogers CIT 3 Learning Objectives At the end of this module, you will be able to: Describe the difference between a forensic copy and a backup; Explain the importance of capturing the “truest” state of the media as possible with today’s technology; Describe the accepted procedure to ensure integrity of the images; Discuss the issues surrounding data acquisition; Demonstrate mastery of the topic by actually acquiring a forensic image.
Image of page 3

Info icon This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document Right Arrow Icon
© 2007 Purdue University Marcus K. Rogers CIT 4 The imaging process “Look Ma no DNA”
Image of page 4
© 2007 Purdue University Marcus K. Rogers CIT 5 Rules of Thumb Make 2 copies of the original media 1 copy becomes the working copy 1 copy is a library/control copy Verify the integrity of the copies to the original The working copy is used for the analysis The library copy is stored for disclosure purposes or in the event that the working copy becomes corrupted If performing a drive to drive imaging (not an image file) use clean media to copy to! Shrink wrapped new drives – REMEMBER TO CHECK Next best, zero another drive Verify the integrity of all images!
Image of page 5

Info icon This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document Right Arrow Icon
© 2007 Purdue University Marcus K. Rogers CIT 6 Statistics 69% of users use disk images rather than disk copies and 20% use partition images. 48% of copies and images are made in the field and 36% are made in laboratories. 57% of the drives imaged are larger than 8.4GB and 35% are less than that size. 50% of the drives imaged require IDE BIOS/Extended BIOS access and 63% require direct (ASPI) SCSI access. 25 to 33% of users sometimes mix IDE and SCSI drives in making images or copies, 25% often do so, and 13% always do. **Source NIST CFTT Project
Image of page 6
© 2007 Purdue University Marcus K. Rogers CIT 7 Drive Imaging We will consider the following 2 scenarios System is off System is live Examples will use open source tools (dd & netcat) What circumstances may require the system to remain live? Hardware/Software RAID Manually mounted volumes/filesystems – ??
Image of page 7

Info icon This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document Right Arrow Icon
© 2007 Purdue University Marcus K. Rogers CIT 8 Part 1 - Hardware Setup “You can do it!”
Image of page 8
© 2007 Purdue University Marcus K. Rogers CIT 9 Technology Overview Learning Objectives At the end of Part 1, you will be able to: – Describe the different parts of the Write Blocker Ultra Kits – Explain the hardware setup necessary to create a forensic image – Describe how to verify the hardware write blocker is functioning correctly
Image of page 9

Info icon This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document Right Arrow Icon
© 2007 Purdue University Marcus K. Rogers CIT 10 Ultra Kit Write Blocker The Ultra Kits are one of the more complete kits for imaging requirements 1 IDE Write Blocker
Image of page 10
Image of page 11
This is the end of the preview. Sign up to access the rest of the document.
  • Spring '12
  • Dr.MarcRogers
  • Hard disk drive, Floppy disk, Marcus K. Rogers, Purdue University Marcus, University Marcus K., Disk enclosure

{[ snackBarMessage ]}

What students are saying

  • Left Quote Icon

    As a current student on this bumpy collegiate pathway, I stumbled upon Course Hero, where I can find study resources for nearly all my courses, get online help from tutors 24/7, and even share my old projects, papers, and lecture notes with other students.

    Student Picture

    Kiran Temple University Fox School of Business ‘17, Course Hero Intern

  • Left Quote Icon

    I cannot even describe how much Course Hero helped me this summer. It’s truly become something I can always rely on and help me. In the end, I was not only able to survive summer classes, but I was able to thrive thanks to Course Hero.

    Student Picture

    Dana University of Pennsylvania ‘17, Course Hero Intern

  • Left Quote Icon

    The ability to access any university’s resources through Course Hero proved invaluable in my case. I was behind on Tulane coursework and actually used UCLA’s materials to help me move forward and get everything together on time.

    Student Picture

    Jill Tulane University ‘16, Course Hero Intern