1

I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine. Since some of the commercial products are very expensive I'm turning to open source solutions.

Provided that:

  • is an offline copy (the compromised disk is not live)
  • it's Linux based and uses partclone (or dd, but I'm not sure about that one)
  • with the help of the advanced options you can encrypt the copy, hash it and copy "empty" sector

In forensics, is the RAW filesystem of the image a requirement or is it not that important?

Improve this question
4
  • Legal forensics or simply incident analysis?
    – schroeder ♦
    May 12, 2021 at 18:34
  • Mainly incident analysis but i would like to know if a clone imaged obtained that way could still represent a valid proof
    – Jack
    May 12, 2021 at 19:39
  • From a legal perspective I would assume that only the original disk can be seen as proof. All copies are just to be able to work with something without having to access and may be accidentally alter the original disk.
    – Robert
    May 12, 2021 at 19:59
  • @Robert, that is not correct - typically we work from copies to protect the original. But they need to be cloned using a forensically sound tool, chain of custody needs to be ensured etc.
    – Rory Alsop ♦
    May 13, 2021 at 8:02

2 Answers 2

Reset to default
1

No Clonezilla is not a Forensic tool. Even using it for incident analysis is not recommended. Can it be useful, yes, but there are better free tools available for forensic and incident analysis.

Yes RAW filesystem is important. It's where all the deleted files and fragments exist.

Improve this answer
3
  • Thanks for the answer! Could you please name a few of said softwares?
    – Jack
    May 13, 2021 at 11:10
  • @Jack - I'm not going to make specifc software recommendations. Instead I suggest you Google the following: open source forensics .
    – user10216038
    May 13, 2021 at 16:33
  • Agreed, there are plenty of free tools to image. Most companies make their money on programs that process the image.
    – user2320464
    Jun 5, 2021 at 14:06
0

No, Clonezilla is not a Forensically sound tool. It will skip information from slack space, if any. Try Guymager. It's Forensically sound, easy to use with a GUI. Multi-threading really saves a lot of time.

https://guymager.sourceforge.io/

Improve this answer
1
  • Imaging is generally I/O bound. Multithreading doesn't really make a difference.
    – user10216038
    Jun 5, 2021 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .