COEN 252 Computer Forensics Forensic Duplication of Hard

Forensics Duplicates as Admissible Evidence n n Federal Rules of Evidence § 1002 requires

Forensics Duplicates as Admissible Evidence n F. R. E. § 1001 (3) If data

Forensics Duplicates as Admissible Evidence n Federal Rules of Evidence § 1003 A duplicate

Forensics Duplicates as Admissible Evidence n As familiarity with digital data increases, behavior of

Reasons for Forensics Duplication n n The examination can destroy evidence inadvertently. The original

Definition of Forensic Duplication Able to produce identical byte stream from duplicate as from

Definitions n n Forensic Duplicate: File that contains every bit of information from the

Definitions n Restored Image: A forensic duplicate or qualified forensic duplicate restored to another

Definitions n n Mirror Image created from hardware that does a bitto-bit copy from

Creating a Forensics Duplicate of a Hard Drive n n Hardware Mirroring. Can be

Creating a Forensics Duplicate of a Hard Drive n Hardware Imager n Creates forensic

Creating a Forensics Duplicate of a Hard Drive n Current and Future Issues n

Creating a Forensics Duplicate of a Hard Drive Software tools: Unix dd n Tested

Creating a Forensics Duplicate of a Hard Drive Software tools: Encase n Expensive. n

Creating a Forensics Duplicate of a Hard Drive n n Software Tools: Safeback Specialized

Creating a Forensics Duplicate of a Hard Drive n FTK n Drive Duplication tool

Write-blocking n Software or hardware tool that prevents writes to a disk. n n

Write-blocking n Hardware write blocking n n n Simple device put between the disk

Write-blocking n Hardware write blocking n n Use hardware write blocking devices as a

Equipment Needs n n Set of write blockers Set of cables, converters, … Forensics

NIST n n n http: //www. cftt. nist. gov/ Digital Data Acquisition Tool Test

Slides: 22

Download presentation

COEN 252 Computer Forensics Forensic Duplication of Hard Drives

Forensics Duplicates as Admissible Evidence n n Federal Rules of Evidence § 1002 requires an original to prove the content of a writing, record, or photograph. Follows from the best evidence rule: Copying can introduce errors.

Forensics Duplicates as Admissible Evidence n F. R. E. § 1001 (3) If data are stored in a computer or similar device, any printout or other output readable by sight, shown to reflect the data accurately, is an "original".

Forensics Duplicates as Admissible Evidence n Federal Rules of Evidence § 1003 A duplicate is admissible to the same extent as an original unless (1) a genuine question is raised to the authenticity of the original or (2) in the circumstances it would be unfair to admit the duplicate in lieu of the original.

Forensics Duplicates as Admissible Evidence n As familiarity with digital data increases, behavior of the judicial system will increase in rationality.

Reasons for Forensics Duplication n n The examination can destroy evidence inadvertently. The original computer system might only be available for capturing.

Definition of Forensic Duplication Able to produce identical byte stream from duplicate as from the original.

Definitions n n Forensic Duplicate: File that contains every bit of information from the source in a raw bitstream format. Qualified Duplicate: Same as above, but allows embedded metadata or certain types of compression.

Definitions n Restored Image: A forensic duplicate or qualified forensic duplicate restored to another storage medium. n Difficult to do if second hard drive does not have the same geometry as the previous one.

Definitions n n Mirror Image created from hardware that does a bitto-bit copy from one hard drive to another. Issue with disk and file system metadata such as boot sectors.

Creating a Forensics Duplicate of a Hard Drive n n Hardware Mirroring. Can be done in the field.

Creating a Forensics Duplicate of a Hard Drive n Hardware Imager n Creates forensic duplicate from suspect drive to evidence drive n n Sector by Sector Copy Needs n n (Integrated) Write Blocker Verification of copy n n n MD 5, SHA 1 of complete copy Logging of results Deal with operation errors n Confusion between suspect and evidence drive

Creating a Forensics Duplicate of a Hard Drive n Current and Future Issues n Large data size n n Storage crosses devices n n Read errors become more likely RAID Level 5, 6 Need for acquisition from a life system

Creating a Forensics Duplicate of a Hard Drive Software tools: Unix dd n Tested and proven. n Runs on Unix/Linux/Mac OS X which can recognize almost any hardware. n Free.

Creating a Forensics Duplicate of a Hard Drive Software tools: Encase n Expensive. n Full Suite of Forensics Tools. n Great Market Penetration. n Based on Windows, which can be a problem, since Windows might “discover” a drive connected to the system.

Creating a Forensics Duplicate of a Hard Drive n n Software Tools: Safeback Specialized Imaging Tool. Uses DOS Target Drive needs FAT 32.

Creating a Forensics Duplicate of a Hard Drive n FTK n Drive Duplication tool included in the Forensic Tool Kit

Write-blocking n Software or hardware tool that prevents writes to a disk. n n Software tools are hard to validate. All forensics tools need to be validated before use. n n Manufacturers offer expert testimony when tools are challenged Forensics institutes publish test results n n n Test images at Purdue Examiners might to do some testing as well. Publication in peer-reviewed journals increases value of testimony

Write-blocking n Hardware write blocking n n n Simple device put between the disk and the interface. Allows acknowledgments of writes to the system on which the drive is mounted, but does not write. Easy to validate by design and experiment

Write-blocking n Hardware write blocking n n Use hardware write blocking devices as a standard means to prevent overwriting evidence when making a forensic duplicate Keep a variety of hardware blockers around because they do not always work. n (System does not recognize drive).

Equipment Needs n n Set of write blockers Set of cables, converters, … Forensics portable (usually not laptop) for software acquisition Hardware duplicator

NIST n n n http: //www. cftt. nist. gov/ Digital Data Acquisition Tool Test Assertions and Test Plan Digital Data Acquisition Tool Specification Disk Imaging Specifications 3. 1. 6 n n n The top-level disk imaging tool requirements are the following: The tool shall make a bit-stream duplicate or an image of an original disk or partition. The tool shall not alter the original disk. The tool shall be able to verify the integrity of a disk image file. The tool shall log I/O errors. The tool’s documentation shall be correct.