Title: 4. Using Acquisition Tools
Course: IN 2005 Digital Forensics > Section: Module 4: Chapter 4 - Data Acquisition

Using Acquisition Tools

1. Advantages and disadvantages of using acquisition tools for Windows, including:
  - Make acquiring evidence from a suspect drive more convenient, especially when you use them with hot-swappable devices
  - You must protect acquired data with a well-tested write-blocking hardware device
  - Tools can’t acquire data from a disk’s host protected area

Windows XP Write-Protection with USB Devices

1. The USB write-protection feature in Windows XP SP2 blocks any writing to USB devices. The disadvantage is that the target drive needs to be connected to an internal PATA (IDE), SATA, or SCSI controller.
2. 4-2 describes the steps to update the Registry for Windows XP SP2, including:
  - Back up the Registry
  - Modify the Registry with the write-protection feature
  - Create two desktop icons to automate switching between enabling and disabling writes to the USB device

Acquiring Data with a Linux Boot CD

1. Linux can access a drive that isn’t mounted. Windows OSs and newer Linux automatically mount and access a drive.  Forensic Linux Live CDs don’t access media automatically, which eliminates the need for a write-blocker.
2. Forensic Linux Live CDs contain additionally utilities and are con d not to mount, or to mount as read-only, any connected storage media.
3. Some of the well-designed Linux Live CDs for computer forensics, such as: Helix, Penguin Sleuth and FCCU.
4. Linux distributions can create Microsoft FAT and NTFS partition tables.
5. Partition and format a Microsoft FAT drive from Linux using the fdisk and mkfs.msdos commands.
6. The dd (“dump data”) command can be used to read and write data from a media device and a data file.  The dd command creates a raw format file that most computer forensics analysis tools can read.
7. The shortcomings of using the dd command, including:
  - Requires more advanced skills than the average computer user might have
  - Does not compress data
8. The dd command combined with the split command segments output into separate volumes.
9. The dd command is intended as a data management tool; it’s not designed for forensics acquisitions.  The dcfldd command offers additional capabilities, including:
  - Specify hexadecimal patterns or text for clearing disk space
  - Log errors to an output file for analysis and review
  - Use several hashing options
  - Refer to a status display indicating the progress of the acquisition in bytes
  - Split data acquisitions into segmented volumes with numeric extensions
  - Verify the acquired data with the original disk or media data

Capturing an Image with ProDiscover Basic

1. Steps for connecting the suspect’s drive to your workstation, including:
  - Document the chain of evidence for the drive
  - Remove the drive from the suspect’s computer
  - Configure the suspect drive’s jumpers as needed
  - Connect the suspect drive
  - Create a storage folder on the target drive
2. Figures 4-4 and 4-5 describes the steps to acquire data using ProDiscover’s proprietary acquisition format.

Capturing an Image with AccessData FTK Imager

1. FTK Imager is included on the AccessData Forensic Toolkit.
2. FTK Imager allows you to view evidence disks and disk-to-image files. It also makes disk-to-image copies of evidence drives at logical partition and physical drive level, and can segment the image file. See Figure 4-6.
3. The evidence drive must have a hardware write-blocking device or the USB write-protection Registry feature enabled. FTK Imager can’t acquire a drive’s host protected area.
4. See Figures 4-7 through 4-10 to explain the steps to capture an image with AccessData FTK Imager, as described in this section.