What do I need to be aware of to select a transfer method for digital forensic data?

Question

I have a question which relates to use of forensics technology to gather evidence from mobile / portable workstation / devices?

I would try to better explain this scenario, by considering a work environment where us(as technical security team) gets call for investigation to the xyz location to gather some kind of digital evidence. Right now, we don't have the forensics means to do so , just relying on basic manual means to gather the data.E.g searching file histroy, temp folders.

Now, after a month of deliberation working out the benefits of using forensics technology, we have come up with a strategy where we would be using hard-disk duplicators to fetch data from remote workstation / laptop and writing to write protected hard-disks.

Now, where I'm stuck in the whole process, is how to optimise the transfer of data from the drives into the analysis system. The analysis system in this case would be using EnCase software. I want to know from the list below what would be the optimal way to transfer evidence to analysis systems.

1. Workstation / laptop connected to external hard-drive
2. Workstation / laptop connected to USB interface
3. Workstation / laptop connected to network-connected hard-drive.
4. Also other methods not mentioned in here.

Considering , that in our environment the volume of disk drives fetches to terabytes. For example an image of a terabyte drive when copied to analysis system through whatever channels should be fast enough for forensics software to run complex queries e.g finding deleted files, or access to computer through remote terminal.

I want to know of the method mentioned above what provides the fastest analysis of evidence. Considering, that there is no shortage of space of storing digital evidence in the analysis system.

Answer 1

When computers want to have fast access to hard disks, they use SATA. USB, Firewire... are fine for external disks, but given the choice (i.e. when we are talking about the disk which goes inside the computer), computers use SATA. Therefore, you want to use SATA.

So, for your analysis, you want to:

1. Copy the whole disk to inspect onto a new hard disk. Hard drive duplicators usually use SATA, so you will want to extract the source disk and plug it into the duplicator, along with the destination disk. Good mechanical hard drives top at about 100 to 150 MB/s, so for a 1 TB disk this will take at least two hours. SSD are faster, and make SATA even more important.

2. Plug the copy into the machine which will do the analysis (internal connection, SATA again).

I would recommend against booting the machine to analyze, even on a CDROM or USB key, because this entail fiddling with the BIOS settings, thus "polluting" the crime scene. Also, this would limit your options to USB, and USB-2.0 tops at 60 MB/s (theoretical limit, rarely achieved).

For even faster analysis, make the target disk an SSD (which will have to be big enough to accommodate a complete copy of the source disk, and large SSD are expensive -- but sooooo fast !).

Answer 2

Personally, I'm a big fan of boot to a forensic liveCD (take your pick, EnCase works fine) and then image to an external drive. It's cheap, fast and easy to hand off to a third party (like say, law enforcement).

Answer 3

EnCase has a variety of ways of Acquiring evidence from drives. I highly recommend getting the EnCE Study Guide which includes a large chapter on data acquisition methods.

Couple of tips:

• If the computer is on; leave it on. Encrypted volumes will probably be unlocked/opened. Shutting down the computer will almost certainly lock these, and getting the password from someone who's "guilty" is likely. Use a memory dump utility to snag the contents of RAM. Do your very best not to change anything on the computer.
• Get a USB HD Adapter (preferably with both SATA and PATA) with Write Blocking abilities. These aren't terribly cheap, but makes initial examination much quicker and easier in most cases. Duplicating the drives will be necessary in some cases, especially if the police get involved.
• Bag-n-tag, take photos (even of the most obscure things), document everything extensively.

Answer 4

I can't comment...

To add to @thomas-pornin answer, you should consider a specific hardware duplicator/imager that can create e01/ex01 evidence files. This is the format that EnCase uses and it supports compression which will increase the speed of analysis no matter which interface you use. It recognizes blocks with a fill pattern and records this in the metadata without having to write KiB's of data to the drive.

I know that there are many hardware duplicators that support this, but I am only familiar with one off the top of my head. Tableau TD2 or TD3.