1

I am developing a series of extraction scripts (currently python 2.7) for a university project - these tools will be provided on a bootable USB for use by first responders when encountering a suspect device (PC/Laptop).

I am currently using the CAINE distro as a payload to transport and execute the scripts given it has in-built in write blocking capabilities on all drives. (This is a must for my project) However the absence of persistence on the USB means that any extracted data is lost on unplugging the USB.

Does anyone know of a platform which can provide the same write-blocking capabilies while also enabling persistent storage on the USB? I understand KALI has a persistent mode, however I also believe this does not come with the write-blocking provided by KALI forensic mode.

I would prefer not to build my own custom distro however if this is the only possible method then any documentation or guidance as to where to start would be greatly appreciated. :)

Improve this question
3
  • 1
    You want to write to the USB while maintaining a write block?
    – schroeder ♦
    Jan 23, 2019 at 13:52
  • can you use a 2nd usb stick, or just one?
    – dandavis
    Jan 23, 2019 at 19:46
  • thanks for the responses, ideally I would like to avoid plugging extra devices in given that this could affect the integrity of the suspect device, I will look into including an additional partition on the USB. (Schroeder I would like the drives inside a suspect's device to be mounted with write block, the USB ideally would be writeable to store extracted data.)
    – Ryan Hodgson
    Jan 25, 2019 at 19:46

1 Answer 1

Reset to default
0

Put an additional partition on your USB drive.

Mount it as write enabled from CAINE. Target your extractions to this partition.

Improve this answer
3
  • Am I misunderstanding your question, because this seems too simple?
    – user10216038
    Jan 23, 2019 at 22:05
  • The USB must be plugged into a suspect's (a criminal) pc at a crime scene. This usb must ensure not to make any changes to the suspect's disk integrity, therefore must mount their drives in read-only. It must then execute a script from the USB which parses the suspect's disk for files matching a criteria, the directories of these files must then be stored on the USB for later use in the investigation. Apologies if I failed to get this across and thanks for the response :)
    – Ryan Hodgson
    Jan 25, 2019 at 19:53
  • Yep, that's what I understood. My answer does that. Put CAINE (or whatever) on your USB device. Put another partition on the same USB device. Plug the USB device into the suspects OFF machine and boot into CAINE from your USB. CAINE defaults to readonly so the auspect disk integrity is maintained. This is what you have already done. Now from CAINE, Write mount the additional partition on your USB device. Target the extractions to your additonal USB partition that you just write mounted.
    – user10216038
    Jan 25, 2019 at 22:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .