1

I am working on a forensics policy which covers several countries. One of the options is to have the user device (laptop, workstation) drive acquired (imaged) locally and perform forensics in another country.

The point I am searching information on is the standard (best case) or the best practices (less good case) for the imaging process.

There are several technical possibilities (forensic duplicator, adapters with write protection, pure software solution). The links are just examples.

I would like to understand if the software-only solution is sound enough. The forensic distributions I looked at (CAINE for instance) have only soft blocks, in the sense that there are configured to (hopefully) not allow RW mounts by default. Is this enough?

I saw that there are also attempts to use software write blockers, I am not sure on how accurately they were tested.

The overall question would be: is using a software-only solution to acquire a hard drive image sufficient from a forensics perspective? In practical terms, could someone successfuly claim that since no hardware write-blockers were used, there is a presumption that the disk was modified during the forensics process?

  • A side question: if going the physical way, how are you going to move the drives through the customs and later claim they weren't tampered with? IMHO you'd need legal counsel to set up the "best" routine. – Deer Hunter Apr 10 '15 at 15:47
  • @DeerHunter: the whole exercise is done closely with legal. There are horrendous complications with international forensics - my question follows ideas about a possible simplification. I have the feeling that the area is not that well established (the international perspective) and I am therefore seeking possible experience, particularly on the "do not do it" side. – WoJ Apr 10 '15 at 17:02
0

The overall question would be: is using a software-only solution to acquire a hard drive image sufficient from a forensics perspective?

It depends on the purpose. If you are responding to an incident and you have a need to image the drive without disturbing the machine, then if could be appropriate to use software write-blocking.

However, if you think the results are going to be used in court, I'd say please just use a hardware write-blocker. If only because the preservation/protection of the data is more manifestly apparent... and appearances mean a lot in some cases.

  • Thanks, but I am ideally looking for something more tangible, like actual cases where the evidence for a given country was taken in one of the ways (hardware / software) and was successfully presented or refuted. – WoJ Apr 11 '15 at 11:27
0

This paper in Digital Investigation gives a definite answer. From the conclusion:

We conclude that even though disk alterations are made, they can be documented through experimentation, which can help during an investigation when a question arises on the integrity of using a bootable CD/DVD during an investigation. With the proper testing to support their choice of examination environment and to document and explain any minor changes that environment may make to the original disk, it may therefore be possible for an examiner to justify the use of a particular bootable CD/ DVD. Whether any changes are justifiable or not, what is certain is that rigorous testing of bootable forensic examination environments is required to support their usage in digital forensics, and that such environments, even community-developed forensics-dedicated distributions, cannot be assumed to be safe without such testing

So the answer is "do not use it" to avoid nitpicking during trial.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.