16

Forensics books often recommend working on an image of the hard drive instead of the original drive.

Should I take this precaution even if I use a write blocker? If so, why?

Improve this question
2
  • 5
    Because I reflashed the harddrive firmware with something nasty.
    – Joshua
    Oct 6, 2015 at 16:39
  • @Joshua - funny! but that would affect accessing data at any stage, even in original acquisition of an image.
    – WMIF
    Nov 13, 2015 at 2:18

7 Answers 7

Reset to default
37

Because normal read operation on a disk presenting error (physical or logical) may cause data corruption, destruction and even writing to recover bad blocks.

You have to keep in mind that even the read operation may lead to physical damage or data modification.

Improve this answer
5
  • 5
    Even without physical damage, it seems possible to have a lying hard drive (but I don't know if such things really exist in the wild).
    – Reyssor
    Oct 5, 2015 at 15:54
  • Absolutely right. The displacement of a bad block may occur due to a physical damage, but also due to a transient logical error diagnosed (too many retries) by the disk controller which was overloaded on another internal task.
    – dan
    Oct 6, 2015 at 7:07
  • 2
    Doesn't the case that such a harddrive may fail during the analysis, loosing the "evidences" matter too? Further, in case of forensics on a criminal act, I can think of (local) laws or regulations that require one image to be taken and kept safe besides the one an engineer is operating with.
    – try-catch-finally
    Oct 6, 2015 at 16:32
  • 1
    Of course. There is one case which you can't protect yourself of anyway. This is the case of the disk which is an evidence and on the verge of dying. The write blocker nor the backup image won't save it from its coming death. This probability is small. On the other hand, the probability of killing a disk by reading repeatedly Gbytes of log can't be neglected.
    – dan
    Oct 6, 2015 at 18:52
  • @Reyssor: I seem to recall that either the Snowden catalogue or the Equation Group's leak included tools to sneak malware into hard disk drives' firmware, so it probably exists in the wild.
    – dig
    Apr 3, 2018 at 17:51
12

Should i take this precaution even if i use a write blocker?

You need to worry about working on an image of the hard drive instead of the original drive because even if a write-blocker has a read-access only to your hard drive(s), you must remember that a common cause of HDD failure is a head crash where a read–write head of a hard disk drive comes in contact with its rotating platter. Because this is a type of physical failure, a write blocker makes no difference.

Improve this answer
0
6

A write blocker prevents the modification of the source disk. So your images made with are exactly identical to the source. If you connect a disk it is possible that it may be modified by the OS.

Moreover, with a writeblocker, you keep the conformity of the source and legally it is a crucial point.

In the end, it is better to work on a copy and not on the original. If error occurs during operation you will destroy the original and so the legal proof.

Improve this answer
4
  • 6
    No. A write blocker prevents the host computer from sending write commands to the disk. It doesn't prevent the disk from modifying itself (e.g. SSDs with garbage collection algorithms, or bad block recovery on magnetic disks like Daniel mentioned)
    – Ben Voigt
    Oct 5, 2015 at 16:50
  • Of course, a write-blocker will block all commands from an OS. But it will never blocks commands internally to the disk. So, put a SSD (as you said @Ben Voigt) drive behind a write-blocker is useless because it can "move" datas to prevent problems and you will never have the same hash after a copy with a write-blocker or a duplicator.
    – Sorcha
    Oct 5, 2015 at 17:00
  • 3
    You will get the same hash, @Sorcha (except if there is a defect) even on a ssd, because the low level storage layer on which the SSD moves the data is never exposed to you. If you read one byte at position x, it will always be on position x to you, no matter on which flash chip it is actually stored. (That's unless you open the SSD and directly read out the flash chips)
    – Josef
    Oct 6, 2015 at 12:39
  • @Josef - I wish I could give you 100 points for that comment. It is like ordering toilet paper from Amazon. You always go to the same webpage, but Amazon will store and ship from whatever physical warehouse makes the most sense for them.
    – WMIF
    Nov 13, 2015 at 1:29
4

You have two problems.

  • Not changing the disk.
  • Proving you have not changed the disk.

Keeping the disk in a safe that needs two keys to open and having two people hold the keys is a lot easier to explain to a court then a “write blocker”. Using a image allows you to keep the original disk in the safe apart from when the image is made.

Improve this answer
4
  • 1
    If you don't use a write blocker, your imaging process may have changed the disk (and in fact usually will). Write blockers are essential for your process to stand up in court.
    – Reid Rankin
    Nov 13, 2015 at 2:13
  • @MrNerdHair, I hope a stand-a-lone imaging machine will have taken account of this in its design.
    – Ian Ringrose
    Nov 13, 2015 at 12:30
  • 1
    The primary function of the write blocker is not to block writes. It's to provide a defense in court to the charge that you changed the drive contents. You need a device designed and marketed to do that, preferably by a reputable company whose devices have held up in other court cases. You should definitely image the disk, but you should just as definitely use a write blocker (or a commercial standalone forensic imager).
    – Reid Rankin
    Nov 13, 2015 at 12:38
  • I was assuming that a "commercial standalone forensic imager" was a given for anyone doing this!
    – Ian Ringrose
    Nov 13, 2015 at 23:46
2

In reality, taking an image of a hard drive is recommended as a best practice. It is not a requirement. There are times that don't warrant an image being made. Being an expert in the field gives you the ability to make that decision. Just make sure that you can articulate the reason(s) why you did not follow best practice procedures and you will be fine.

Generally, you make an image of the drive to prevent physical damage to the original drive, as mentioned in other answers. The longer a drive is active, the more chance there is to let the magic smoke out. Part of the process of making an image is also making a backup copy of the image and recording the MD5 (or other algorithm) at the time of acquisition. This ensures that the image you have taken remains the same during the course of investigation and allows you to validate that the image is still the same years later if/when the case gets time in court.

There are also times when a scenario requires (or suggests) that a drive be returned to the owner immediately after being seized. This can be for many reasons, but some are corporate investigations, investigation of victim machines, and cases where the defendant has convinced a judge that it is a financial hardship to be without their data.

This obviously raises the question of being able to validate the image against the original drive, and thats where the 'best evidence rule' comes into play. It is accepted by many courts that a digital copy of a drive or file is the same as the original. This rule originated with written words or pictures on paper in times before a copy machine. The only way to duplicate those pages was to transcribe, and that process could introduce errors. Surely a copy/paste operation can also introduce error with a digital file, but thats where we have the likes of MD5 to save the day with mathematical validation.

Additionally, there are some tools available to parse data that are not able to access certain protected areas of the file systems. Processing against an image removes those complexities. Some examples would be $MFT, $UsnJrnl, $Catalog, Inode table, and more. Windows can also get in the way of accessing ACL restricted folders of a drive, if you are parsing files from the disk and not block data from the sectors.

There are also times when you don't want to take the time of creating an image. For law enforcement on scene of a search, the search warrant often limits the computers that can be taken away in seizure. There is criteria stated that requires agents to do a triage to identify expected artifacts, and only then can they be taken back to the lab.

Another situation that wouldn't require an image is for a drive that is not expected to contain many (or any) artifacts. Examiners will do some poking around and targeted searches with the drive attached through a write blocker before spending the time to image it.

Drives image currently at a maximum rate of 16 GiB per minute. That is a best case scenario with the fastest blocker/imager (Tableau TD2u) and the fastest drives. The speed only goes down from there based on numerous factors.

Lastly, because some image formats support compression (e01), searching can actually be faster since large blocks of 0x00 can be flat-out ignored. It also saves you the hassle of having to string up all the equipment and power adapters required to use a write blocker.

Source: 15 years experience in digital forensics, both in corporate and law enforement.

Improve this answer
2
  • +1 for mentioning speed. If the disk is slow, take an image and work with it on something faster (i.e. SSD, etc.).
    – user2320464
    Jun 11, 2016 at 4:38
  • MD5 is considered broken by now, as in collisions can be generated on demand using reasonably cheap computers, and a competent opposing attorney might be able to convince a court it does not provide sufficient defence against tampering. I believe 256-bit SHA-2 is the current practical minimum for evidential-quality cryptographic hashes. SHA-1 collisions are still expensive to create, but a trial can take several years plus appeals, and computrons will only get cheaper.
    – dig
    Apr 3, 2018 at 17:59
1

As it cannot be disputed that it is necessary to operate an evidence hard drive once to take an image before an investigation, you're clear in terms of the law. Claiming that it was necessary to operate it more than that (because you were too lazy to take an image) is likely to lead to many complicated questions, having to prove your actions, and putting evidence at risk in case of hardware failure.

Evidence hard drives should always be treated that:

  • They are more important than your personal photos
  • They are about to fail
Improve this answer
1

In addition to what has already been mentioned, it is sometimes useful to be able to write onto the evidence hard drive, for example to link deleted files back into the filesystem. In that case, the only option is to use an image. (You COULD use copy-on-write, but given that images have other advantages as well there's really no reason to use copy-on-write instead of an image unless you've got very limited working space - in which case you shouldn't be doing computer forensics work.)

Improve this answer
3
  • I get doing the relinking of deleted files as an exercise to understand the file system mechanism, but you are doing things the extremely hard way if you are doing that on a real case. Too many tools available to take care of that for you in memory without modifying the disk or image. EnCase, FTK, X-Ways, Autopsy, etc.
    – WMIF
    Nov 13, 2015 at 1:32
  • Still, you might want to store that somewhere other than "in memory".
    – micheal65536
    Nov 13, 2015 at 10:14
  • Of course. All of those tools store their work in case files or databases.
    – WMIF
    Nov 13, 2015 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .