Practical Forensic Imaging
Total Page：16
File Type：pdf, Size：1020Kb
INDEX The letter t following a page number denotes AFF (Advanced Forensic Format) a table; the letter f following a page number aff4imager tool, 190 denotes a figure. affcat tool, 209–210 affconvert tool, 204–205, 209 affcrypto tool, 215 Numbers affinfo tool, 198, 210, 211 4Kn disks, 12, 41–44, 42f AFFlib software package 512e sector emulation, 41, 42, 43 affuse tool, 196–197, 235 built-in compression, 190 A built-in encryption, 215 overview, 62 abstraction layers, disk interfaces, 34, 35f piping, 209 AccessData. See ftkimager tool; FTK signing and validating SMART format signatures, 202 Ace Laboratory PC-3000 tool, 122 built-in compression, 190 ACPO (Association of Chief Police built-in encryption, 215 Officers), UK, 2, 6–7 converting raw images to, 204–205 acquisition host converting to another format, attaching subject disk to 209–211 Apple Target Disk Mode, 137–138 overview, 62–63 devices with block or character piping, 209 access, 140 recalculating hash of forensic image, enabling access to hidden sectors, 198–199 118–125 AHCI (Advanced Host Controller examining subject PC hardware, Interface), mode, SATA, 101–102 23–24 identifying subject drive, 105–107 aimage tool, 190 NVME SSDs, 138–139 Appelbaum, Jacob, 251 querying subject disk, 107–118 Apple removable storage media, 132–136 FileVault, 248–251 viewing examiner workstation Target Disk Mode, 31, 137–138 hardware, 103–104 Thunderbolt interface, 30–32, 31f, 137 performance, optimizing, 88–90 array-info tool, 178 acquisition process. See forensic Association of Chief Police Officers acquisition (ACPO), UK, 2, 6–7 ACS (ATA Command Set). See ATA ATA (Advanced Technology Attachment) commands commands Advanced Forensic Format. See AFF common, 35t Advanced Format 4Kn disks, 12, DCO and HPA drive areas, 39–40 41–44, 42f overview, 34–36 Advanced Format 512e disks, 41, 42, 43 password-protected disks, 126–128 Advanced Host Controller Interface and SCSI, 39 (AHCI) mode, SATA, 23–24 security erase command, 226–227 Advanced Technology Attachment SSD devices, 16–17 commands. See ATA ATA Command Set (ACS). See ATA commands commands ATAPI (ATA Packet Interface) boot images, preparing with xmount, DCO and HPA drive areas, 39–40 235–237 overview, 35–36 BOT (Beginning of Tape) marker, password-protected disks, 126–128 on tapes, 176 SCSI commands, 39 BOT (Bulk-Only Transport) USB Atola Insight Forensic, 122 interface, 29, 40–41 auditd package, 76 bottlenecks, performance, 88–90, 91t audit trail Bourne Again shell (Bash), 56, 73, 74, 82. overview, 70 See also command line shell history, 73–75 Bulk-Only Transport (BOT) USB task management, 70–73 interface, 29, 40–41 terminal monitors and Linux burning forensic image to optical disc, auditing, 76 221–222 terminal recorders, 75–76 bus speeds, 90, 91t. See also interfaces aureport command, 76 bzip tool, 188, 189 B C Bash (Bourne Again shell), 56, 73, 74, 82. CA (certificate authority) certificates, See also command line 156, 157, 201–202 Bash math expansion, 183, 248, 249, 252, C.A.I.N.E. boot CD, 99 265, 274 card readers, 18 bdeinfo command, 248 Carrier, Brian, 48 bdemount command, 248 carving tools, 165 BDs. See Blu-ray discs; optical storage cat command, 196, 199 media cciss-vol-status package, 178 Beginning of Media (BOM) marker, CDB (command descriptor block), 36 on tapes, 176 cd-drive command, 132–133 Beginning of Tape (BOT) marker, cd-info command, 133 on tapes, 176 cdparanoia tool, 175 BitLocker, Microsoft, 243–248 CDs (compact discs). See also optical blkcat command, 274 storage media blkls command, 271–272 acquiring, 174, 175 blktap-utils tool, 241 Linux forensic boot, 98, 99 blockdev command, 43, 98, 99, 108 as storage media, 19f, 20–21 block devices transferring forensic image to, acquiring, 172–173 221–222 attaching to acquisition host, 140 certificate authority (CA) certificates, creating from raw image, 230 156, 157, 201–202 Linux, 50–55 CF (CompactFlash) card, 18 making QCOW2 image available as, CFTT (Computer Forensic Tool Testing) 237–239 project block-level encryption systems. See dd utility tests, 60 encrypted filesystems, forensic-imaging requirements, 9 accessing HWB Device Specification, 94 Blu-ray discs (BDs), 19f, 21–22. See also overview, 3, 6 optical storage media software write blockers, 99 acquiring, 174, 175 chip-off, 15, 125 transferring forensic image to, Choudary, Omar, 248 222, 223 CipherShed, 217 BOM (Beginning of Media) marker, client mode, rdd tool, 166, 167–168 on tapes, 176 cloned disks, 219–221 bootable Linux CDs, 98, 99 Coltel, Romain, 243 command descriptor block (CDB), 36 278 Index command line. See also Linux; specific key-wiping procedures, 227–228 commands/tools RFC-3161 timestamping, 157–159 audit trail, 70–76 signing forensic images, 154–157 command privileges, xxv, 212, 233 verifying forensic image integrity, organizing output, 76–83 197–202 output cryptsetup tool, 251–254, 257 organizing, 76–83 CTRL-Z shortcut, 92–93, 123 redirecting, 81–83 curl command, 158 scalable examination directory structure, 79–81 reasons to use, xx–xxi D saving output with redirection, 81–83 dares carver tool, 165 shell history, 73–75 data CDs, 20. See also CDs; optical storage task management, 70–73 media terminal monitors and Linux data disposal, 224–228 auditing, 76 data extraction terminal recorders, 75–76 manual, using offsets, 272–274 viewing examiner workstation partition extraction, 264–271 hardware, 103–104 partition scheme analysis, 259–264 command sets slack space, 271–272 ATA, 34–36, 35t unallocated blocks, 272 NVME, 37–38, 37t data flow, optimizing, 90 SCSI, 36–37, 37t, 39 data recovery tools, 61–62, 162–163 compact discs. See CDs; optical storage dc3dd tool media acquiring image to multiple CompactFlash (CF) card, 18 destinations, 150 completeness, forensic, 10 cryptographic hashing algorithms, completion times, estimating, 87–88 151–152, 151t compression error handling, 160–161 AFFlib built-in, 190 forensic acquisition with, 142, 144–145 combining with splitting, 192 optical discs, imaging, 174–175 EnCase EWF compressed format, 189 overview, 61 FTK SMART compressed format, 190 piecewise hashing, 153–154 SquashFS, 66–67, 191 splitting functionality, 193 Computer Forensic Tool Testing project. SquashFS forensic evidence See CFTT project containers, 65, 149 computer-related forensics. See digital wiping functionality, 225–226 forensics; forensic acquisition writing image file to clone disk, converting between image formats, 220–221 202–211 dcfldd tool conv=noerror parameter, dd utility, 143 acquiring image to multiple copying forensic images, 87 destinations, 150 Copy-on-Write (CoW) snapshots, live compressing images, 189 imaging with, 172 cryptographic hashing algorithms, Coroner’s Toolkit, The, 2 151, 151t Corsair Padlock2 thumb drive, 228 encryption during acquisition, 212 CoW (Copy-on-Write) snapshots, live error handling, 160 imaging with, 172 forensic acquisition with, 142, cpqarrayd tool, 178 144 –145 cryptography. See also encrypted hash windows, 153 filesystems, accessing; overview, 61 encryption partition extraction, 266 basic hashing, 151–152, 151t splitting functionality, 192–193 hash windows, 143, 152–154, 199–200 tapes, extracting data from, 177 Index 279 DCO (Device Configuration Overlay) digital forensics. See also forensic extracting sector ranges belonging acquisition to, 269–271 defined, 2 overview, 39–40, 118 history of, 1–4 removing, 118–121 Linux and OSS in context of, 48–50 dd_rescue tool, 61, 62, 142, 163, 215–216 peer-reviewed research, 7–8 ddrescue tool, 61, 142, 162–163, 165 principles of, 6–10 dd utility standards for, 6–7 combining compressing and trends and challenges, 4–5 splitting, 192 Digital Investigation: The International cryptographic hashing Journal of Digital Forensics & algorithms, 152 Incident Response, 7 forensic acquisition with, 142–144 digital signatures, 154–157 forensic variants, 61, 144–145 digital versatile discs. See DVDs; optical manual extraction using offsets, storage media 273–274 directories partition extraction, 266 naming conventions for, 76–79 raw images, 60 scalable examination structure, 79–81 secure remote imaging, 168, 169–170 disk block recovery tools, 162–163 sparse files, 85 disk cloning and duplication, 219–221 validating acquisition hash, 197–198 disk coolers, 93 wiping functionality, 226 disk imaging. See forensic acquisition debug ports, accessing storage media disk partition scheme, analyzing, 259–264 using, 122–125 disks. See forensic acquisition; storage decryption. See also cryptography; media; subject disk encrypted filesystems, disktype tool, 260–261, 263 accessing; encryption dislocker package, 243–247 of GPG-encrypted image, 212, 213 dismounting VeraCrypt volume, 218. See of OpenSSL-encrypted file, 213–214 also unmounting DEFT (Digital Evidence & Forensics disposal, data, 224–228 Toolkit), 98 –99 distributions, Linux, 55–56 deleted partitions, extracting, 266–268 dm-crypt encryption, 251, 254 deleting forensic image data, 224–228 dmesg tool, 206 desktop environments, Linux, 56 dmraid tool, 178 –179 /dev directory, Linux, 50, 51–52 dmsetup tool, 159–160, 179–180, 182, 183 Device Configuration Overlay. See DCO documenting device identification device mapper, 179–182, 231–232, 253, details, 107–108 255–256 DOS partition scheme, 262 device tree, Linux, 50–51 dpt-i2o-raidutils package, 178 DFRWS (Digital Forensic Research drive maintenance sectors, 40, 122–125 Workshop), 2, 8, 59 drives. See forensic acquisition; specific diagnostic ports, accessing storage media media; storage media; using, 122–125 subject disk Diaz Diaz, Antonio,