Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?

share|improve this question
up vote 7 down vote accepted

The most important part of the forensic investigation is to prove beyond a doubt the integrity of your evidence.

A good way to do this is to compare the hash of the acquired disk image against the hash of the original disk which should have been taken when the disk is recovered from the crime scene. Said hash should most probably be on the chain of custody form.

If a hardware write blocker cannot be used, I would suggest booting the system in question into a live Linux CD that mounts the disk in read-only mode. A forensics live CD like Helix can do this automatically.

Instead of using the standard dd tool, I would suggest dcfldd, a version of dd specifically for forensics use. It has a bunch of features useful for forensics investigation that the standard dd tool does not, such as on-the-fly hashing.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.