Title: 7.Using Remote Network Acquisitions Tools
Course: IN 2005 Digital Forensics > Section: Module 4: Chapter 4 - Data Acquisition

Using Remote Network Acquisition Tools

1. You can remotely connect to a suspect computer via a network connection and copy data from it. Remote acquisition tools vary in configurations and capabilities.
2. Some of the drawbacks of acquiring data through a network, including:
  - LAN’s data transfer speeds and routing table conflicts could cause problems
  - Gaining the permissions needed to access more secure subnets
  - Heavy traffic could cause delays and errors

Remote Acquisition with ProDiscover

1. The functions available through ProDiscover Investigator, including:
  - Preview a suspect’s drive remotely while it’s in use
  - Perform a live acquisition
  - Encrypt the connection
  - Copy the suspect computer’s RAM
  - Use the optional stealth mode
2. The additional functions available through ProDiscover Incident Response, including:
  - Capture volatile system state information
  - Analyze current running processes
  - Locate unseen files and processes
  - Remotely view and listen to IP ports
  - Run hash comparisons
  - Create a hash inventory of all files on a system remotely
3. The PDServer remote agent is the ProDiscover utility for remote access and needs to be loaded on the suspect computer before a remote connection can be established.
4. The PDServer installation modes, including:
  - Trusted CD
  - Preinstallation
  - Pushing out and running remotely
5. PDServer has the option of running in a stealth mode. In addition, you can change the process name so that it appears to be an OS function.
6. The remote connection security features offered by ProDiscover, including:
  - Password Protection
  - Encryption
  - Secure Communication Protocol
  - Write Protected Trusted Binaries
  - Digital Signatures

Remote Acquisition with EnCase Enterprise

1. The remote acquisition features available through EnCase Enterprise, including:
  - Remote data acquisition of a computer’s media and RAM data
  - Integration with intrusion detection system (IDS) tools
  - Options to create an image of data from one or more systems
  - Preview of systems
  - A wide range of file system formats
  - RAID support for both hardware and software

Remote Acquisition with R-Tools R-Studio

1. The R-Tools suite of software is designed for data recovery. Its remote connection uses Triple Data Encryption Standard (3DES) encryption.
2. R-Studio creates raw format acquisitions and supports various file systems.

Remote Acquisition with Runtime Software

1. The utilities offered by Runtime Software, including:
  - DiskExplorer for FAT
  - DiskExplorer for NTFS
  - HDHOST
2. The acquisition features offered by Runtime Software, including:
  - Create a raw format image file
  - Segment the raw format or compressed image
  - Access network computers’ drives