If the suspect's computer is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk image? Or do you need to use forensic live cds like Helix, Penguin sleuth or FFCU on top of the existing OS?
1
-
What do you mean by "can't be removed", as in it's somehow impossible to remove physically or the warrant won't allow it?– k1308517Jul 4, 2016 at 13:44
Add a comment
|
1 Answer
Simply turning on the machine can already alter/destroy data that can be potential evidence, let alone booting its original OS.
The best solution is to remove the hard drive, connect it to another computer through a hardware write blocker and then grab a complete image of it with dd or some equivalent. The write blocker is necessary to prevent accidental write to the device that may alter potential evidence (although a basic Linux installation that doesn't mount drives automatically won't do any writes by itself, Mac OS and Windows will definitely do).
If that's not possibly then you need to go with the forensics Live-CD route, but since it involves booting the computer you may already trigger some firmware-embedded code designed to alter/destroy potential evidence (hard but not impossible to do, it depends on what kind of criminal you're after).
Note that in the end, it doesn't matter what OS was installed on the computer since you shouldn't boot that OS anyway, and a bit-by-bit copy doesn't care about the data or even the filesystem that's on the drive (you can copy encrypted drives, but that won't help you much if you don't have the key since the copy is still encrypted).
-
I see. The situation says that for some reason, the drive cannot be removed from the scene, though. Is it not true that forensic live cds, like those mentioned above, does not need write blockers anymore? Sep 9, 2014 at 12:55
-
1Yeah, but after all it depends on how well you trust the Live-CD to not do anything bad/destructive with the data. A write blocker is a fail-safe for just in case.– user42178Sep 9, 2014 at 12:59