Table of Contents for
Practical Forensic Imaging

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition Practical Forensic Imaging by Bruce Nikkel Published by No Starch Press, 2016
  1. Practical Forensic Imaging
  2. Practical Forensic Imaging
  3. Practical Forensic Imaging
  4. Practical Forensic Imaging
  5. Practical Forensic Imaging
  6. Practical Forensic Imaging
  7. Practical Forensic Imaging
  8. Practical Forensic Imaging
  9. Practical Forensic Imaging
  10. Practical Forensic Imaging
  11. Practical Forensic Imaging
  12. Practical Forensic Imaging
  13. Practical Forensic Imaging
  14. Practical Forensic Imaging
  15. Practical Forensic Imaging
  16. Practical Forensic Imaging
  17. Practical Forensic Imaging
  18. Practical Forensic Imaging
  19. Practical Forensic Imaging
  20. Practical Forensic Imaging
  21. Practical Forensic Imaging
  22. Practical Forensic Imaging
  23. Practical Forensic Imaging
  24. Practical Forensic Imaging
  25. Practical Forensic Imaging

Contents in Detail

  1. Cover Page
  2. Title Page
  3. Copyright Page
  4. Dedication
  5. About the Author
  6. Brief Contents
  7. Contents in Detail
  8. Foreword by Eoghan Casey
  9. Introduction
    1. Why I Wrote This Book
    2. How This Book Is Different
    3. Why Use the Command Line?
    4. Target Audience and Prerequisites
      1. Who Should Read This Book?
      2. Prerequisite Knowledge
      3. Preinstalled Platform and Software
    5. How the Book Is Organized
    6. The Scope of This Book
    7. Conventions and Format
  10. Chapter 0: Digital Forensics Overview
    1. Digital Forensics History
      1. Pre-Y2K
      2. 2000–2010
      3. 2010–Present
    2. Forensic Acquisition Trends and Challenges
      1. Shift in Size, Location, and Complexity of Evidence
      2. Multijurisdictional Aspects
      3. Industry, Academia, and Law Enforcement Collaboration
    3. Principles of Postmortem Computer Forensics
      1. Digital Forensic Standards
      2. Peer-Reviewed Research
      3. Industry Regulations and Best Practice
      4. Principles Used in This Book
  11. Chapter 1: Storage Media Overview
    1. Magnetic Storage Media
      1. Hard Disks
      2. Magnetic Tapes
      3. Legacy Magnetic Storage
    2. Non-Volatile Memory
      1. Solid State Drives
      2. USB Flash Drives
      3. Removable Memory Cards
      4. Legacy Non-Volatile Memory
    3. Optical Storage Media
      1. Compact Discs
      2. Digital Versatile Discs
      3. Blu-ray Discs
      4. Legacy Optical Storage
    4. Interfaces and Physical Connectors
      1. Serial ATA
      2. Serial Attached SCSI and Fibre Channel
      3. Non-Volatile Memory Express
      4. Universal Serial Bus
      5. Thunderbolt
      6. Legacy Interfaces
    5. Commands, Protocols, and Bridges
      1. ATA Commands
      2. SCSI Commands
      3. NVME Commands
      4. Bridging, Tunneling, and Pass-Through
    6. Special Topics
      1. DCO and HPA Drive Areas
      2. Drive Service and Maintenance Areas
      3. USB Attached SCSI Protocol
      4. Advanced Format 4Kn
      5. NVME Namespaces
      6. Solid State Hybrid Disks
    7. Closing Thoughts
  12. Chapter 2: Linux as a Forensic Acquisition Platform
    1. Linux and OSS in a Forensic Context
      1. Advantages of Linux and OSS in Forensics Labs
      2. Disadvantages of Linux and OSS in Forensics Labs
    2. Linux Kernel and Storage Devices
      1. Kernel Device Detection
      2. Storage Devices in /dev
      3. Other Special Devices
    3. Linux Kernel and Filesystems
      1. Kernel Filesystem Support
      2. Mounting Filesystems in Linux
      3. Accessing Filesystems with Forensic Tools
    4. Linux Distributions and Shells
      1. Linux Distributions
      2. The Shell
      3. Command Execution
      4. Piping and Redirection
    5. Closing Thoughts
  13. Chapter 3: Forensic Image Formats
    1. Raw Images
      1. Traditional dd
      2. Forensic dd Variants
      3. Data Recovery Tools
    2. Forensic Formats
      1. EnCase EWF
      2. FTK SMART
      3. AFF
    3. SquashFS as a Forensic Evidence Container
      1. SquashFS Background
      2. SquashFS Forensic Evidence Containers
    4. Closing Thoughts
  14. Chapter 4: Planning and Preparation
    1. Maintain an Audit Trail
      1. Task Management
      2. Shell History
      3. Terminal Recorders
      4. Linux Auditing
    2. Organize Collected Evidence and Command Output
      1. Naming Conventions for Files and Directories
      2. Scalable Examination Directory Structure
      3. Save Command Output with Redirection
    3. Assess Acquisition Infrastructure Logistics
      1. Image Sizes and Disk Space Requirements
      2. File Compression
      3. Sparse Files
      4. Reported File and Image Sizes
      5. Moving and Copying Forensic Images
      6. Estimate Task Completion Times
      7. Performance and Bottlenecks
      8. Heat and Environmental Factors
    4. Establish Forensic Write-Blocking Protection
      1. Hardware Write Blockers
      2. Software Write Blockers
      3. Linux Forensic Boot CDs
      4. Media with Physical Read-Only Modes
    5. Closing Thoughts
  15. Chapter 5: Attaching Subject Media to an Acquisition Host
    1. Examine Subject PC Hardware
      1. Physical PC Examination and Disk Removal
      2. Subject PC Hardware Review
    2. Attach Subject Disk to an Acquisition Host
      1. View Acquisition Host Hardware
      2. Identify the Subject Drive
    3. Query the Subject Disk for Information
      1. Document Device Identification Details
      2. Query Disk Capabilities and Features with hdparm
      3. Extract SMART Data with smartctl
    4. Enable Access to Hidden Sectors
      1. Remove a DCO
      2. Remove an HPA
      3. Drive Service Area Access
    5. ATA Password Security and Self-Encrypting Drives
      1. Identify and Unlock ATA Password-Protected Disks
      2. Identify and Unlock Opal Self-Encrypting Drives
      3. Encrypted Flash Thumb Drives
    6. Attach Removable Media
      1. Optical Media Drives
      2. Magnetic Tape Drives
      3. Memory Cards
    7. Attach Other Storage
      1. Apple Target Disk Mode
      2. NVME SSDs
      3. Other Devices with Block or Character Access
    8. Closing Thoughts
  16. Chapter 6: Forensic Image Acquisition
    1. Acquire an Image with dd Tools
      1. Standard Unix dd and GNU dd
      2. The dcfldd and dc3dd Tools
    2. Acquire an Image with Forensic Formats
      1. The ewfacquire Tool
      2. AccessData ftkimager
      3. SquashFS Forensic Evidence Container
      4. Acquire an Image to Multiple Destinations
    3. Preserve Digital Evidence with Cryptography
      1. Basic Cryptographic Hashing
      2. Hash Windows
      3. Sign an Image with PGP or S/MIME
      4. RFC-3161 Timestamping
    4. Manage Drive Failure and Errors
      1. Forensic Tool Error Handling
      2. Data Recovery Tools
      3. SMART and Kernel Errors
      4. Other Options for Failed Drives
      5. Damaged Optical Discs
    5. Image Acquisition over a Network
      1. Remote Forensic Imaging with rdd
      2. Secure Remote Imaging with ssh
      3. Remote Acquisition to a SquashFS Evidence Container
      4. Acquire a Remote Disk to EnCase or FTK Format
      5. Live Imaging with Copy-On-Write Snapshots
    6. Acquire Removable Media
      1. Memory Cards
      2. Optical Discs
      3. Magnetic Tapes
    7. RAID and Multidisk Systems
      1. Proprietary RAID Acquisition
      2. JBOD and RAID-0 Striped Disks
      3. Microsoft Dynamic Disks
      4. RAID-1 Mirrored Disks
      5. Linux RAID-5
    8. Closing Thoughts
  17. Chapter 7: Forensic Image Management
    1. Manage Image Compression
      1. Standard Linux Compression Tools
      2. EnCase EWF Compressed Format
      3. FTK SMART Compressed Format
      4. AFFlib Built-In Compression
      5. SquashFS Compressed Evidence Containers
    2. Manage Split Images
      1. The GNU split Command
      2. Split Images During Acquisition
      3. Access a Set of Split Image Files
      4. Reassemble a Split Image
    3. Verify the Integrity of a Forensic Image
      1. Verify the Hash Taken During Acquisition
      2. Recalculate the Hash of a Forensic Image
      3. Cryptographic Hashes of Split Raw Images
      4. Identify Mismatched Hash Windows
      5. Verify Signature and Timestamp
    4. Convert Between Image Formats
      1. Convert from Raw Images
      2. Convert from EnCase/E01 Format
      3. Convert from FTK Format
      4. Convert from AFF Format
    5. Secure an Image with Encryption
      1. GPG Encryption
      2. OpenSSL Encryption
      3. Forensic Format Built-In Encryption
      4. General Purpose Disk Encryption
    6. Disk Cloning and Duplication
      1. Prepare a Clone Disk
      2. Use HPA to Replicate Sector Size
      3. Write an Image File to a Clone Disk
    7. Image Transfer and Storage
      1. Write to Removable Media
      2. Inexpensive Disks for Storage and Transfer
      3. Perform Large Network Transfers
    8. Secure Wiping and Data Disposal
      1. Dispose of Individual Files
      2. Secure Wipe a Storage Device
      3. Issue ATA Security Erase Unit Commands
      4. Destroy Encrypted Disk Keys
    9. Closing Thoughts
  18. Chapter 8: Special Image Access Topics
    1. Forensically Acquired Image Files
      1. Raw Image Files with Loop Devices
      2. Forensic Format Image Files
      3. Prepare Boot Images with xmount
    2. VM Images
      1. QEMU QCOW2
      2. VirtualBox VDI
      3. VMWare VMDK
      4. Microsoft VHD
    3. OS-Encrypted Filesystems
      1. Microsoft BitLocker
      2. Apple FileVault
      3. Linux LUKS
      4. TrueCrypt and VeraCrypt
    4. Closing Thoughts
  19. Chapter 9: Extracting Subsets of Forensic Images
    1. Assess Partition Layout and Filesystems
      1. Partition Scheme
      2. Partition Tables
      3. Filesystem Identification
    2. Partition Extraction
      1. Extract Individual Partitions
      2. Find and Extract Deleted Partitions
      3. Identify and Extract Inter-Partition Gaps
      4. Extract HPA and DCO Sector Ranges
    3. Other Piecewise Data Extraction
      1. Extract Filesystem Slack Space
      2. Extract Filesystem Unallocated Blocks
      3. Manual Extraction Using Offsets
    4. Closing Thoughts
  20. Closing Remarks
  21. Index
  22. Updates
  23. “An indispensible reference for anyone responsible for preserving digital evidence.” —Professor Eoghan Casey, University of Lausanne
  24. Footnotes
    1. Chapter 0: Digital Forensics Overview
    2. Chapter 1: Storage Media Overview
    3. Chapter 2: Linux as a Forensic Acquisition Platform
    4. Chapter 3: Forensic Image Formats
    5. Chapter 4: Planning and Preparation
    6. Chapter 5: Attaching Subject Media to an Acquisition Host
    7. Chapter 6: Forensic Image Acquisition
    8. Chapter 7: Forensic Image Management
    9. Chapter 8: Special Image Access Topics
  1. i
  2. ii
  3. iii
  4. iv
  5. v
  6. vi
  7. vii
  8. viii
  9. ix
  10. x
  11. xi
  12. xii
  13. xiii
  14. xiv
  15. xv
  16. xvi
  17. xvii
  18. xviii
  19. xix
  20. xx
  21. xxi
  22. xxii
  23. xxiii
  24. xxiv
  25. xxv
  26. xxvi
  27. 1
  28. 2
  29. 3
  30. 4
  31. 5
  32. 6
  33. 7
  34. 8
  35. 9
  36. 10
  37. 11
  38. 12
  39. 13
  40. 14
  41. 15
  42. 16
  43. 17
  44. 18
  45. 19
  46. 20
  47. 21
  48. 22
  49. 23
  50. 24
  51. 25
  52. 26
  53. 27
  54. 28
  55. 29
  56. 30
  57. 31
  58. 32
  59. 33
  60. 34
  61. 35
  62. 36
  63. 37
  64. 38
  65. 39
  66. 40
  67. 41
  68. 42
  69. 43
  70. 44
  71. 45
  72. 46
  73. 47
  74. 48
  75. 49
  76. 50
  77. 51
  78. 52
  79. 53
  80. 54
  81. 55
  82. 56
  83. 57
  84. 58
  85. 59
  86. 60
  87. 61
  88. 62
  89. 63
  90. 64
  91. 65
  92. 66
  93. 67
  94. 68
  95. 69
  96. 70
  97. 71
  98. 72
  99. 73
  100. 74
  101. 75
  102. 76
  103. 77
  104. 78
  105. 79
  106. 80
  107. 81
  108. 82
  109. 83
  110. 84
  111. 85
  112. 86
  113. 87
  114. 88
  115. 89
  116. 90
  117. 91
  118. 92
  119. 93
  120. 94
  121. 95
  122. 96
  123. 97
  124. 98
  125. 99
  126. 100
  127. 101
  128. 102
  129. 103
  130. 104
  131. 105
  132. 106
  133. 107
  134. 108
  135. 109
  136. 110
  137. 111
  138. 112
  139. 113
  140. 114
  141. 115
  142. 116
  143. 117
  144. 118
  145. 119
  146. 120
  147. 121
  148. 122
  149. 123
  150. 124
  151. 125
  152. 126
  153. 127
  154. 128
  155. 129
  156. 130
  157. 131
  158. 132
  159. 133
  160. 134
  161. 135
  162. 136
  163. 137
  164. 138
  165. 139
  166. 140
  167. 141
  168. 142
  169. 143
  170. 144
  171. 145
  172. 146
  173. 147
  174. 148
  175. 149
  176. 150
  177. 151
  178. 152
  179. 153
  180. 154
  181. 155
  182. 156
  183. 157
  184. 158
  185. 159
  186. 160
  187. 161
  188. 162
  189. 163
  190. 164
  191. 165
  192. 166
  193. 167
  194. 168
  195. 169
  196. 170
  197. 171
  198. 172
  199. 173
  200. 174
  201. 175
  202. 176
  203. 177
  204. 178
  205. 179
  206. 180
  207. 181
  208. 182
  209. 183
  210. 184
  211. 185
  212. 186
  213. 187
  214. 188
  215. 189
  216. 190
  217. 191
  218. 192
  219. 193
  220. 194
  221. 195
  222. 196
  223. 197
  224. 198
  225. 199
  226. 200
  227. 201
  228. 202
  229. 203
  230. 204
  231. 205
  232. 206
  233. 207
  234. 208
  235. 209
  236. 210
  237. 211
  238. 212
  239. 213
  240. 214
  241. 215
  242. 216
  243. 217
  244. 218
  245. 219
  246. 220
  247. 221
  248. 222
  249. 223
  250. 224
  251. 225
  252. 226
  253. 227
  254. 228
  255. 229
  256. 230
  257. 231
  258. 232
  259. 233
  260. 234
  261. 235
  262. 236
  263. 237
  264. 238
  265. 239
  266. 240
  267. 241
  268. 242
  269. 243
  270. 244
  271. 245
  272. 246
  273. 247
  274. 248
  275. 249
  276. 250
  277. 251
  278. 252
  279. 253
  280. 254
  281. 255
  282. 256
  283. 257
  284. 258
  285. 259
  286. 260
  287. 261
  288. 262
  289. 263
  290. 264
  291. 265
  292. 266
  293. 267
  294. 268
  295. 269
  296. 270
  297. 271
  298. 272
  299. 273
  300. 274
  301. 275
  302. 276
  303. 277
  304. 278
  305. 279
  306. 280
  307. 281
  308. 282
  309. 283
  310. 284
  311. 285
  312. 286
  313. 287
  314. 288
  315. 289
  316. 290
  317. 291
  318. 292
  319. 293
  320. 294
  321. 295
  322. 296
Back to top