6

If a hardware blocker cannot be acquired could an investigator use DD without a write blocker, would that be forensically sound?

7

The most important part of the forensic investigation is to prove beyond a doubt the integrity of your evidence.

A good way to do this is to compare the hash of the acquired disk image against the hash of the original disk which should have been taken when the disk is recovered from the crime scene. Said hash should most probably be on the chain of custody form.

If a hardware write blocker cannot be used, I would suggest booting the system in question into a live Linux CD that mounts the disk in read-only mode. A forensics live CD like Helix can do this automatically.

Instead of using the standard dd tool, I would suggest dcfldd, a version of dd specifically for forensics use. It has a bunch of features useful for forensics investigation that the standard dd tool does not, such as on-the-fly hashing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.