Disk imaging process of making a exact copy of a

Disk imaging
process of making a exact copy of a drive.

Tools for forensic imaging
Encase FTK
Types of data acquisition
static, live
Data acquisition methods
...
Static and live data acquisition
Data evidence that is collected while the system is on/of
Validating forensic data (hashing)
a algorithm used to produce a checksum of a drive or password. this can be used to verify that nothing
has changed.
MD5
popular version of hash
dd and dcfldd commands
dd: used to wipe a drive and ensure no residual data left from a previous case.
WinAudit
Portable application that gives a detailed information of installed software.
Tools used in computer forensics and their purpose
Encase: allows the examiner to connect an Ethernet cable or null modem cable to a suspect machine and
to view the data on that machine. also prevents the examiner from making any accidental changes to the
suspect machine.
The Forensic Toolkit : cracking passwords, search windows registry and examining emails.

Helix: Linux live CD used to boot the suspect system using the CD.
Sweepers or scrubbers
devices used to clean unallocated space.
Swap file
windows uses the swap file to write data when additional RAM is needed. a virtual memory extension.
Netstat command
Shows network statistics and any current connections.
Net sessions command
shows only established network communication sessions.
Host protected area
An area where computer vendors could store data that is protected from user activities and OS utilities
such as delete and format.