Table of Contents for
Practical Forensic Imaging
Practical Forensic Imaging
Published by
No Starch Press, 2016
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
- Practical Forensic Imaging
CONTENTS IN DETAIL
Target Audience and Prerequisites
Preinstalled Platform and Software
Forensic Acquisition Trends and Challenges
Shift in Size, Location, and Complexity of Evidence
Industry, Academia, and Law Enforcement Collaboration
Principles of Postmortem Computer Forensics
Industry Regulations and Best Practice
Interfaces and Physical Connectors
Serial Attached SCSI and Fibre Channel
Commands, Protocols, and Bridges
Bridging, Tunneling, and Pass-Through
Drive Service and Maintenance Areas
2
LINUX AS A FORENSIC ACQUISITION PLATFORM
Linux and OSS in a Forensic Context
Advantages of Linux and OSS in Forensics Labs
Disadvantages of Linux and OSS in Forensics Labs
Linux Kernel and Storage Devices
Accessing Filesystems with Forensic Tools
Linux Distributions and Shells
SquashFS as a Forensic Evidence Container
SquashFS Forensic Evidence Containers
Organize Collected Evidence and Command Output
Naming Conventions for Files and Directories
Scalable Examination Directory Structure
Save Command Output with Redirection
Assess Acquisition Infrastructure Logistics
Image Sizes and Disk Space Requirements
Moving and Copying Forensic Images
Estimate Task Completion Times
Heat and Environmental Factors
Establish Forensic Write-Blocking Protection
Media with Physical Read-Only Modes
5
ATTACHING SUBJECT MEDIA TO AN ACQUISITION HOST
Physical PC Examination and Disk Removal
Attach Subject Disk to an Acquisition Host
View Acquisition Host Hardware
Query the Subject Disk for Information
Document Device Identification Details
Query Disk Capabilities and Features with hdparm
Extract SMART Data with smartctl
Enable Access to Hidden Sectors
ATA Password Security and Self-Encrypting Drives
Identify and Unlock ATA Password-Protected Disks
Identify and Unlock Opal Self-Encrypting Drives
Other Devices with Block or Character Access
Acquire an Image with dd Tools
Acquire an Image with Forensic Formats
SquashFS Forensic Evidence Container
Acquire an Image to Multiple Destinations
Preserve Digital Evidence with Cryptography
Sign an Image with PGP or S/MIME
Manage Drive Failure and Errors
Other Options for Failed Drives
Image Acquisition over a Network
Remote Forensic Imaging with rdd
Secure Remote Imaging with ssh
Remote Acquisition to a SquashFS Evidence Container
Acquire a Remote Disk to EnCase or FTK Format
Live Imaging with Copy-On-Write Snapshots
Standard Linux Compression Tools
SquashFS Compressed Evidence Containers
Split Images During Acquisition
Access a Set of Split Image Files
Verify the Integrity of a Forensic Image
Verify the Hash Taken During Acquisition
Recalculate the Hash of a Forensic Image
Cryptographic Hashes of Split Raw Images
Identify Mismatched Hash Windows
Verify Signature and Timestamp
Convert from EnCase/E01 Format
Secure an Image with Encryption
Forensic Format Built-In Encryption
General Purpose Disk Encryption
Use HPA to Replicate Sector Size
Write an Image File to a Clone Disk
Inexpensive Disks for Storage and Transfer
Perform Large Network Transfers
Secure Wiping and Data Disposal
Issue ATA Security Erase Unit Commands
Forensically Acquired Image Files
Raw Image Files with Loop Devices
Prepare Boot Images with xmount
9
EXTRACTING SUBSETS OF FORENSIC IMAGES
Assess Partition Layout and Filesystems
Find and Extract Deleted Partitions
Identify and Extract Inter-Partition Gaps
Extract HPA and DCO Sector Ranges
Other Piecewise Data Extraction
Extract Filesystem Slack Space
Extract Filesystem Unallocated Blocks