Title: 5. Performing Remote Acquisitions
Course: IN 2005 Digital Forensics > Section: Module 9: Chapter 9 - Computer Forensics Analysis and Validation

Performing Remote Acquisitions

1. Remote acquisitions are handy when you need to image the drive of a computer far away from your location or when you don’t want a suspect to be aware of an ongoing investigation.

Remote Acquisitions with Runtime Software

1. Runtime Software offers the following shareware programs for remote acquisitions:
  - DiskExplorer for FAT
  - DiskExplorer for NTFS
  - HDHOST
2. Preparing DiskExplorer and HDHOST for remote acquisitions requires the Runtime software, a portable media device (USB thumb drive or floppy disk) and two networked computers.
3. Making a remote connection with DiskExplorer requires running HDHOST on a suspect’s computer.
4. To establish a connection with HDHOST, the suspect’s computer must be connected to the network, powered on and logged on to any user account with permission to run noninstalled applications. HDHOST can’t be run surreptitiously.
5. See Figures 9-18 through 9-24 to show how to establish a connection with HDHOST.
6. After you have established a connection with DiskExplorer from the acquisition workstation, you can navigate through the suspect computer’s files and folders or copy data.  See Figure 9-25.
7. The Runtime tools don’t generate a hash for acquisitions.