Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

The most important part of the forensic investigation is to prove beyond a doubt the integrity of your evidence.

A good way to do this is to compare the hash of the acquired disk image against the hash of the original disk which should have been taken when the disk is recovered from the crime scene. Said hash should most probably be on the chain of custody form.

If a hardware write blocker cannot be used, I would suggest booting the system in question into a live Linux CD that mounts the disk in read-only mode. A forensics live CD like Helix can do this automatically.

Instead of using the standard dd tool, I would suggest dcfldd, a version of dd specifically for forensics use. It has a bunch of features useful for forensics investigation that the standard dd tool does not, such as on-the-fly hashing.

share|improve this answer
    
Your first sentence is missing something –  BrianAdkins Apr 13 '13 at 17:17
    
@BrianAdkins Blah, thanks. Fixed that. –  Terry Chia Apr 13 '13 at 17:18
    
Perfect, thank you. I was not sure if the live cd interfaced with the hard drive in a forensically unsound manner. –  Ninja2k Apr 13 '13 at 17:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.