Table of Contents for
Practical Forensic Imaging
Close
Version ebook
/
Retour
Practical Forensic Imaging
by Bruce Nikkel
Published by No Starch Press, 2016
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Practical Forensic Imaging
Contents in Detail
Cover Page
Title Page
Copyright Page
Dedication
About the Author
Brief Contents
Contents in Detail
Foreword by Eoghan Casey
Introduction
Why I Wrote This Book
How This Book Is Different
Why Use the Command Line?
Target Audience and Prerequisites
Who Should Read This Book?
Prerequisite Knowledge
Preinstalled Platform and Software
How the Book Is Organized
The Scope of This Book
Conventions and Format
Chapter 0: Digital Forensics Overview
Digital Forensics History
Pre-Y2K
2000–2010
2010–Present
Forensic Acquisition Trends and Challenges
Shift in Size, Location, and Complexity of Evidence
Multijurisdictional Aspects
Industry, Academia, and Law Enforcement Collaboration
Principles of Postmortem Computer Forensics
Digital Forensic Standards
Peer-Reviewed Research
Industry Regulations and Best Practice
Principles Used in This Book
Chapter 1: Storage Media Overview
Magnetic Storage Media
Hard Disks
Magnetic Tapes
Legacy Magnetic Storage
Non-Volatile Memory
Solid State Drives
USB Flash Drives
Removable Memory Cards
Legacy Non-Volatile Memory
Optical Storage Media
Compact Discs
Digital Versatile Discs
Blu-ray Discs
Legacy Optical Storage
Interfaces and Physical Connectors
Serial ATA
Serial Attached SCSI and Fibre Channel
Non-Volatile Memory Express
Universal Serial Bus
Thunderbolt
Legacy Interfaces
Commands, Protocols, and Bridges
ATA Commands
SCSI Commands
NVME Commands
Bridging, Tunneling, and Pass-Through
Special Topics
DCO and HPA Drive Areas
Drive Service and Maintenance Areas
USB Attached SCSI Protocol
Advanced Format 4Kn
NVME Namespaces
Solid State Hybrid Disks
Closing Thoughts
Chapter 2: Linux as a Forensic Acquisition Platform
Linux and OSS in a Forensic Context
Advantages of Linux and OSS in Forensics Labs
Disadvantages of Linux and OSS in Forensics Labs
Linux Kernel and Storage Devices
Kernel Device Detection
Storage Devices in /dev
Other Special Devices
Linux Kernel and Filesystems
Kernel Filesystem Support
Mounting Filesystems in Linux
Accessing Filesystems with Forensic Tools
Linux Distributions and Shells
Linux Distributions
The Shell
Command Execution
Piping and Redirection
Closing Thoughts
Chapter 3: Forensic Image Formats
Raw Images
Traditional dd
Forensic dd Variants
Data Recovery Tools
Forensic Formats
EnCase EWF
FTK SMART
AFF
SquashFS as a Forensic Evidence Container
SquashFS Background
SquashFS Forensic Evidence Containers
Closing Thoughts
Chapter 4: Planning and Preparation
Maintain an Audit Trail
Task Management
Shell History
Terminal Recorders
Linux Auditing
Organize Collected Evidence and Command Output
Naming Conventions for Files and Directories
Scalable Examination Directory Structure
Save Command Output with Redirection
Assess Acquisition Infrastructure Logistics
Image Sizes and Disk Space Requirements
File Compression
Sparse Files
Reported File and Image Sizes
Moving and Copying Forensic Images
Estimate Task Completion Times
Performance and Bottlenecks
Heat and Environmental Factors
Establish Forensic Write-Blocking Protection
Hardware Write Blockers
Software Write Blockers
Linux Forensic Boot CDs
Media with Physical Read-Only Modes
Closing Thoughts
Chapter 5: Attaching Subject Media to an Acquisition Host
Examine Subject PC Hardware
Physical PC Examination and Disk Removal
Subject PC Hardware Review
Attach Subject Disk to an Acquisition Host
View Acquisition Host Hardware
Identify the Subject Drive
Query the Subject Disk for Information
Document Device Identification Details
Query Disk Capabilities and Features with hdparm
Extract SMART Data with smartctl
Enable Access to Hidden Sectors
Remove a DCO
Remove an HPA
Drive Service Area Access
ATA Password Security and Self-Encrypting Drives
Identify and Unlock ATA Password-Protected Disks
Identify and Unlock Opal Self-Encrypting Drives
Encrypted Flash Thumb Drives
Attach Removable Media
Optical Media Drives
Magnetic Tape Drives
Memory Cards
Attach Other Storage
Apple Target Disk Mode
NVME SSDs
Other Devices with Block or Character Access
Closing Thoughts
Chapter 6: Forensic Image Acquisition
Acquire an Image with dd Tools
Standard Unix dd and GNU dd
The dcfldd and dc3dd Tools
Acquire an Image with Forensic Formats
The ewfacquire Tool
AccessData ftkimager
SquashFS Forensic Evidence Container
Acquire an Image to Multiple Destinations
Preserve Digital Evidence with Cryptography
Basic Cryptographic Hashing
Hash Windows
Sign an Image with PGP or S/MIME
RFC-3161 Timestamping
Manage Drive Failure and Errors
Forensic Tool Error Handling
Data Recovery Tools
SMART and Kernel Errors
Other Options for Failed Drives
Damaged Optical Discs
Image Acquisition over a Network
Remote Forensic Imaging with rdd
Secure Remote Imaging with ssh
Remote Acquisition to a SquashFS Evidence Container
Acquire a Remote Disk to EnCase or FTK Format
Live Imaging with Copy-On-Write Snapshots
Acquire Removable Media
Memory Cards
Optical Discs
Magnetic Tapes
RAID and Multidisk Systems
Proprietary RAID Acquisition
JBOD and RAID-0 Striped Disks
Microsoft Dynamic Disks
RAID-1 Mirrored Disks
Linux RAID-5
Closing Thoughts
Chapter 7: Forensic Image Management
Manage Image Compression
Standard Linux Compression Tools
EnCase EWF Compressed Format
FTK SMART Compressed Format
AFFlib Built-In Compression
SquashFS Compressed Evidence Containers
Manage Split Images
The GNU split Command
Split Images During Acquisition
Access a Set of Split Image Files
Reassemble a Split Image
Verify the Integrity of a Forensic Image
Verify the Hash Taken During Acquisition
Recalculate the Hash of a Forensic Image
Cryptographic Hashes of Split Raw Images
Identify Mismatched Hash Windows
Verify Signature and Timestamp
Convert Between Image Formats
Convert from Raw Images
Convert from EnCase/E01 Format
Convert from FTK Format
Convert from AFF Format
Secure an Image with Encryption
GPG Encryption
OpenSSL Encryption
Forensic Format Built-In Encryption
General Purpose Disk Encryption
Disk Cloning and Duplication
Prepare a Clone Disk
Use HPA to Replicate Sector Size
Write an Image File to a Clone Disk
Image Transfer and Storage
Write to Removable Media
Inexpensive Disks for Storage and Transfer
Perform Large Network Transfers
Secure Wiping and Data Disposal
Dispose of Individual Files
Secure Wipe a Storage Device
Issue ATA Security Erase Unit Commands
Destroy Encrypted Disk Keys
Closing Thoughts
Chapter 8: Special Image Access Topics
Forensically Acquired Image Files
Raw Image Files with Loop Devices
Forensic Format Image Files
Prepare Boot Images with xmount
VM Images
QEMU QCOW2
VirtualBox VDI
VMWare VMDK
Microsoft VHD
OS-Encrypted Filesystems
Microsoft BitLocker
Apple FileVault
Linux LUKS
TrueCrypt and VeraCrypt
Closing Thoughts
Chapter 9: Extracting Subsets of Forensic Images
Assess Partition Layout and Filesystems
Partition Scheme
Partition Tables
Filesystem Identification
Partition Extraction
Extract Individual Partitions
Find and Extract Deleted Partitions
Identify and Extract Inter-Partition Gaps
Extract HPA and DCO Sector Ranges
Other Piecewise Data Extraction
Extract Filesystem Slack Space
Extract Filesystem Unallocated Blocks
Manual Extraction Using Offsets
Closing Thoughts
Closing Remarks
Index
Updates
“An indispensible reference for anyone responsible for preserving digital evidence.” —Professor Eoghan Casey, University of Lausanne
Footnotes
Chapter 0: Digital Forensics Overview
Chapter 1: Storage Media Overview
Chapter 2: Linux as a Forensic Acquisition Platform
Chapter 3: Forensic Image Formats
Chapter 4: Planning and Preparation
Chapter 5: Attaching Subject Media to an Acquisition Host
Chapter 6: Forensic Image Acquisition
Chapter 7: Forensic Image Management
Chapter 8: Special Image Access Topics
i
ii
iii
iv
v
vi
vii
viii
ix
x
xi
xii
xiii
xiv
xv
xvi
xvii
xviii
xix
xx
xxi
xxii
xxiii
xxiv
xxv
xxvi
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296