1

I am developing a series of extraction scripts (currently python 2.7) for a university project - these tools will be provided on a bootable USB for use by first responders when encountering a suspect device (PC/Laptop).

I am currently using the CAINE distro as a payload to transport and execute the scripts given it has in-built in write blocking capabilities on all drives. (This is a must for my project) However the absence of persistence on the USB means that any extracted data is lost on unplugging the USB.

Does anyone know of a platform which can provide the same write-blocking capabilies while also enabling persistent storage on the USB? I understand KALI has a persistent mode, however I also believe this does not come with the write-blocking provided by KALI forensic mode.

I would prefer not to build my own custom distro however if this is the only possible method then any documentation or guidance as to where to start would be greatly appreciated. :)

  • 1
    You want to write to the USB while maintaining a write block? – schroeder Jan 23 at 13:52
  • can you use a 2nd usb stick, or just one? – dandavis Jan 23 at 19:46
  • thanks for the responses, ideally I would like to avoid plugging extra devices in given that this could affect the integrity of the suspect device, I will look into including an additional partition on the USB. (Schroeder I would like the drives inside a suspect's device to be mounted with write block, the USB ideally would be writeable to store extracted data.) – Ryan Hodgson Jan 25 at 19:46
0

Put an additional partition on your USB drive.

Mount it as write enabled from CAINE. Target your extractions to this partition.

  • Am I misunderstanding your question, because this seems too simple? – user10216038 Jan 23 at 22:05
  • The USB must be plugged into a suspect's (a criminal) pc at a crime scene. This usb must ensure not to make any changes to the suspect's disk integrity, therefore must mount their drives in read-only. It must then execute a script from the USB which parses the suspect's disk for files matching a criteria, the directories of these files must then be stored on the USB for later use in the investigation. Apologies if I failed to get this across and thanks for the response :) – Ryan Hodgson Jan 25 at 19:53
  • Yep, that's what I understood. My answer does that. Put CAINE (or whatever) on your USB device. Put another partition on the same USB device. Plug the USB device into the suspects OFF machine and boot into CAINE from your USB. CAINE defaults to readonly so the auspect disk integrity is maintained. This is what you have already done. Now from CAINE, Write mount the additional partition on your USB device. Target the extractions to your additonal USB partition that you just write mounted. – user10216038 Jan 25 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.