Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

We are working with an contractor regarding a compromised computer. The contractor has asked for a dd dump of the drive. However, my understanding is that dd would allow the contractor to recover deleted files.

How could I produce an image that would be bootable / forensically useful, but not allow for recovery of deleted files?

share|improve this question
Why do you want to prevent the recovery of deleted file? What is the purpose of the dd dump, what is the contractor hoping to find? – this.josh Sep 8 '11 at 19:06

1 Answer

up vote 3 down vote
  • An image created with the dd command would allow for recovery of deleted files.
  • A bit-for-bit copy (dd style) is the only way you'll get something that is likely the only forensically useful approach for law enforcement / court.

While there are ways to compact all the files on a system and copy over / update the boot record, this is not forensic. The only valid forensic approach is to copy everything exactly as it is and preserve that. You may be able to copy everything and then zero out all unallocated space (freespace wipe), but that might limit your ability to use it for anything other than trying to find out what happened. Even then it will limit your ability to discover certain types of attacks.

If your goal is to seek criminal or civil action, you have an uphill battle to show that any kind of modification to the system state is appropriate for evidence in any jurisdiction. From an expert witnesses position for the opposing side, I'd rain hell all over it. This is akin to cleaning the walls before investigating a murder scene.

share|improve this answer
Right, but this isn't becoming evidence. I can't comment further. – SLY Sep 8 '11 at 15:08
1  
Then dd followed by a freespace wipe is the best method to accomplish your goal. superuser.com/questions/19326/… shows some methods and pitfalls for Unix systems. Other systems are left as an exercise for you. – Jeff Ferland♦ Sep 8 '11 at 15:17
I'm thinking of using xcopy instead of dd. – SLY Sep 8 '11 at 16:25
rsync -avR is useful also. In either case, you probably still have to deal with the boot portion of the partition in a different way, or use an external boot process / bootdisk it. (What if a rootkit was in the boot record? Will you be able to still tell?) – Jeff Ferland♦ Sep 8 '11 at 17:30
1  
Incidentally, there are strict chain-of-custody requirements that you have to follow, in addition to what Jeff outlined above. Keep good records the whole way. – Steve Dispensa Sep 8 '11 at 19:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.