1. Data Acquisition Chao-Hsien Chu, Ph.D.
College of Information Sciences and Technology
The Pennsylvania State University
University Park, PA 16802
Theory 
Practice
Learning by
Doing
8/24/06

2. Related Questions – Lab 1
How does a bit-stream image differ from a normal backup copy?
What is the purpose of using a write blocker device for imaging?
What are the advantages and disadvantages of using EnCase/FTK tools to obtain a forensic copy/image of the evidence (as compare with other approaches)?
Under what circumstances should we use a drive-to-drive approach under a DOS environment to acquire image?
What formats of image does EnCase support? How about FTK? Please evaluate and discuss your experience of using these two software tools in terms of functionality, usability, performance, and ease of learning.
Is there any other ways of acquiring images in addition to using the two approaches practice in this lab? Please describe the possible scenarios and approaches.

3. Some Key Issues in E-Discovery
What is admissible evidence?
What is electronic evidence?
Is electronic evidence admissible?
Why pay the cost of collecting electronic evidence?
How to preserve electronic evidence?
What is a defensible approach?
What is chain of custody?

4. Computer Forensics Procedure
Verify Legal Authority
Search warrants
Photographing
Documentation
Location, date, time, witnesses
System information, status
Physical evidence collected
Documentation
Forensically wipe storage drive
Bit-stream Imaging
Documentation
Chain of custody
Acquisition
Hash verification
CRC/MD5/SHA1
Documentation
Authentication
The Defensible Approach
Retain the integrity
Filtering out irrelevant data
What could/could not have happened
Be objective and unbiased
Documentation
Analysis
Interpret and report
Present and defend
Presentation

5. Drive Imaging Drive Imaging Static Mode Live Mode Write Blocker Disk-
Integrity
Time
Interrupt Operations
Equipment
Personnel
Static Mode
Live Mode
Write
Blocker
Disk-
to-Disk
Network-
Based
System is off
Trusted environment
Nonvolatile data
Postmortem analysis
System is on
Untrusted environment
Volatile data
Hacker attacking

6. Imaging: Disk to Disk or Step 1:
Assumes the scene and system have been properly secured.
Remove suspect hard drive from suspect system
Place the suspect drive in forensic system or
Connect power cable and ribbon from forensic computer to suspect drive
Step 2:
Boot the forensic computer
Ensure that the suspect drive is recognized
Start the forensic tool

7. Imaging: Disk to Disk Create bitstream image of the suspect drive
Step 3:
Create bitstream image of the suspect drive
Step 4:
Ensure integrity of source and image (MD5)
Step 5:
Disconnect suspect drive
Shut down forensic computer
Make detailed notes

8. Imaging – Network based
Step 1:
Connect cross over cable or hub to suspect & forensic computers
Boot suspect system from forensic boot disk
Start up the forensic computer
Set IP addresses for both systems
ifconfig eth netmask
ifconfig eth netmask
Ping the one system to ensure connectivity
Verify the date & time reported on the suspect & forensic systems

9. Imaging – Network based
Step 2:
Listening host (MFS) run netcat in listening mode
nc –l –p > /forensics/images/case1.dd
-l = listening mode
-p = port address
> pipes the input to the specified file
Suspect Host
dd bs=1024 < /dev/hda1 | nc –w 3
Run dd set block size to 1024
Pipe the dd input (/dev/hda1) through netcat to the ip address on port 10000

10. Imaging – Network based
Step 3:
Ensure integrity of source and image (md5sum)
Hash totals should match
Step 4:
Shut down the forensic and the suspect system
Remove forensic boot disk
Disconnect cables etc.
Make detailed notes.

11. Drive Imaging – Live System
Assumptions for our example
Suspect system is a UNIX filesystem
Document everything!
Use statically linked binaries
Diskette, CD-ROM
Tools = dd & Netcat

12. Tools - Netcat Some of the features of netcat are:
Designed in 1995 as a network debugging tool
Some of the features of netcat are:
Outbound or inbound connections, TCP or UDP, to or from any ports
Full DNS forward/reverse checking, with appropriate warnings
Ability to use any local source port
Ability to use any locally-configured network source address
Built-in port-scanning capabilities, with randomizer
Built-in loose source-routing capability
Can read command line arguments from standard input
Slow-send mode, one line every N seconds
Optional ability to let another program service inbound connections

13. Drive Imaging – Live System
Step 1:
Connect cross over cable or hub to suspect & MFS
Start up the MFS
Set IP addresses for both systems
ifconfig eth netmask
ifconfig eth netmask
Ping the one system to ensure connectivity
Verify the date & time reported on the suspect & MFS systems (Why is this NB)
Mount CD with statically linked binaries
#/mount /dev/hdc /mnt

14. Drive Imaging – Live System
Step 2
Use netcat & dd to image systems
Netcat syntax:
Listening host (system we are going to store the image on)
nc –l -p > /forensics/images/case1.dd
-l = listening mode
-p = port address
> pipes the input to the specified file
Suspect host (system we want to image)
From the CDROM!
nc <ip address of listening host> <port number> -w 3
nc –w 3
-w is timeout value (in our example 3 seconds)

15. Drive Imaging – Live System
Combining Netcat & dd
Listening host
nc –l -p > /forensics/images/case1.dd
Suspect host
dd bs=1024 < /dev/hda1 | nc –w 3
Run dd set block size to 1024
Pipe the dd input (/dev/hda1) through netcat to the ip address on port 10000
If no data transmitted for 3 seconds then end the process
Our suspect image is now safely on our system and is called case1.dd

16. Drive Imaging – Live System
Step 3
Ensure integrity of source and image (md5sum)
Hash totals should match
Step 4
Shut down the MFS
Disconnect cables etc.
Make detailed notes.

17. Summary
Acquiring an exact copy of the suspect media is difficult. Bitstream copies are acceptable as long as you can demonstrate the integrity of the images.
Acquiring digital evidence should adhere to the second principle of digital forensics (actions should be taken not to change the evidence)
There are several open source tools that can be used
If possible avoid obtaining a image from a live system.
Be conscious of volatile data on live systems

18. Summary Use a forensic boot disk
Make detailed notes as the procedures you follow need to be both auditable and replicable.
Test and validate all tools on a known system
Re-test after upgrading to newer version
Conduct "Before and After" comparisons
Be prepared to testify to your methodology
Whatever software and hardware solution you decide to use, you should personally validate your process, under a variety of conditions, so that you can testify to its reliability.
Experiment with the chosen tools on a known system. Use some of the skills acquired in this course to create hidden data, erased files, slack, bad clusters with data in them, etc., and see if your software/hardware combination copies this information. If it doesn't, you can't rely on it for forensic work.
Use before and after comparisons to ensure that the image you make is identical to the original. Use file comparison or hash routines to compare the original files to the duplicates.
Take and keep notes of your validation process. That way you can testify that you tested the process yourself, rather than relied on someone else's assurance that your imaging tools worked.