Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a question which relates to use of forensics technology to gather evidence from mobile / portable workstation / devices?

I would try to better explain this scenario, by considering a work environment where us(as technical security team) gets call for investigation to the xyz location to gather some kind of digital evidence. Right now, we don't have the forensics means to do so , just relying on basic manual means to gather the data.E.g searching file histroy, temp folders.

Now, after a month of deliberation working out the benefits of using forensics technology, we have come up with a strategy where we would be using hard-disk duplicators to fetch data from remote workstation / laptop and writing to write protected hard-disks.

Now, where I'm stuck in the whole process, is how to optimise the transfer of data from the drives into the analysis system. The analysis system in this case would be using EnCase software. I want to know from the list below what would be the optimal way to transfer evidence to analysis systems.

  1. Workstation / laptop connected to external hard-drive
  2. Workstation / laptop connected to USB interface
  3. Workstation / laptop connected to network-connected hard-drive.
  4. Also other methods not mentioned in here.

Considering , that in our environment the volume of disk drives fetches to terabytes. For example an image of a terabyte drive when copied to analysis system through whatever channels should be fast enough for forensics software to run complex queries e.g finding deleted files, or access to computer through remote terminal.

I want to know of the method mentioned above what provides the fastest analysis of evidence. Considering, that there is no shortage of space of storing digital evidence in the analysis system.

share|improve this question

migrated from serverfault.com Feb 14 '13 at 14:10

This question came from our site for professional system and network administrators.

    
Excellent Question. –  Lex Feb 14 '13 at 14:37
    
Can you expand on why you have those 3 options? Are you imaging machines at the user's desk, or are you taking it to your forensics room so you can properly handle chain of custody? Personally, what I've done in the past is confiscate the computer (or have it already confiscated, did forensics for LEO) and bring it to the forensics lab, which was locked and I was the only one with the code so proper chain of custody can be maintained. What is the purpose of your forensics program? Pursue legal action? If so, you'll need to consider the above. –  g3k Feb 14 '13 at 14:43

4 Answers 4

up vote 4 down vote accepted

When computers want to have fast access to hard disks, they use SATA. USB, Firewire... are fine for external disks, but given the choice (i.e. when we are talking about the disk which goes inside the computer), computers use SATA. Therefore, you want to use SATA.

So, for your analysis, you want to:

  1. Copy the whole disk to inspect onto a new hard disk. Hard drive duplicators usually use SATA, so you will want to extract the source disk and plug it into the duplicator, along with the destination disk. Good mechanical hard drives top at about 100 to 150 MB/s, so for a 1 TB disk this will take at least two hours. SSD are faster, and make SATA even more important.

  2. Plug the copy into the machine which will do the analysis (internal connection, SATA again).

I would recommend against booting the machine to analyze, even on a CDROM or USB key, because this entail fiddling with the BIOS settings, thus "polluting" the crime scene. Also, this would limit your options to USB, and USB-2.0 tops at 60 MB/s (theoretical limit, rarely achieved).

For even faster analysis, make the target disk an SSD (which will have to be big enough to accommodate a complete copy of the source disk, and large SSD are expensive -- but sooooo fast !).

share|improve this answer
    
I did some research on the SSD and there was a nice comparison on the Wikipedia website between HDD and SSD.I have no point in on mechanical level its fast, but what about the cost? It sure is costly with what I have checked. But that won't be really problem where I work. At, the end the way it always works is when the safeguard cost is ALWAYS below the cost of risk imposed. –  Saladin Feb 18 '13 at 7:15
    
@Thomas is absolutely right about speed. Carving files is very slow on USB2 and below. USB3 may be acceptable but I've not tried it. I sometimes boot a copy of the disk so I can compare it with another RO copy. –  Callum Wilson Aug 29 '13 at 13:01

Personally, I'm a big fan of boot to a forensic liveCD (take your pick, EnCase works fine) and then image to an external drive. It's cheap, fast and easy to hand off to a third party (like say, law enforcement).

share|improve this answer

EnCase has a variety of ways of Acquiring evidence from drives. I highly recommend getting the EnCE Study Guide which includes a large chapter on data acquisition methods.

Couple of tips:

  • If the computer is on; leave it on. Encrypted volumes will probably be unlocked/opened. Shutting down the computer will almost certainly lock these, and getting the password from someone who's "guilty" is likely. Use a memory dump utility to snag the contents of RAM. Do your very best not to change anything on the computer.
  • Get a USB HD Adapter (preferably with both SATA and PATA) with Write Blocking abilities. These aren't terribly cheap, but makes initial examination much quicker and easier in most cases. Duplicating the drives will be necessary in some cases, especially if the police get involved.
  • Bag-n-tag, take photos (even of the most obscure things), document everything extensively.
share|improve this answer

I can't comment...

To add to @thomas-pornin answer, you should consider a specific hardware duplicator/imager that can create e01/ex01 evidence files. This is the format that EnCase uses and it supports compression which will increase the speed of analysis no matter which interface you use. It recognizes blocks with a fill pattern and records this in the metadata without having to write KiB's of data to the drive.

I know that there are many hardware duplicators that support this, but I am only familiar with one off the top of my head. Tableau TD2 or TD3.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.