What are the options for acquiring disk image from a Linux computer that can't be removed from a crime scene?

Question

If the suspect's computer is Linux, can you directly use tools such as dd or dcfldd on his computer to acquire the disk image? Or do you need to use forensic live cds like Helix, Penguin sleuth or FFCU on top of the existing OS?

Answer 1

Simply turning on the machine can already alter/destroy data that can be potential evidence, let alone booting its original OS.

The best solution is to remove the hard drive, connect it to another computer through a hardware write blocker and then grab a complete image of it with dd or some equivalent. The write blocker is necessary to prevent accidental write to the device that may alter potential evidence (although a basic Linux installation that doesn't mount drives automatically won't do any writes by itself, Mac OS and Windows will definitely do).

If that's not possibly then you need to go with the forensics Live-CD route, but since it involves booting the computer you may already trigger some firmware-embedded code designed to alter/destroy potential evidence (hard but not impossible to do, it depends on what kind of criminal you're after).

Note that in the end, it doesn't matter what OS was installed on the computer since you shouldn't boot that OS anyway, and a bit-by-bit copy doesn't care about the data or even the filesystem that's on the drive (you can copy encrypted drives, but that won't help you much if you don't have the key since the copy is still encrypted).