{"id":361,"date":"2015-10-19T00:04:00","date_gmt":"2015-10-18T16:04:00","guid":{"rendered":"http:\/\/note.systw.net\/note\/?p=361"},"modified":"2023-10-31T00:08:05","modified_gmt":"2023-10-30T16:08:05","slug":"data-acquisition","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/361","title":{"rendered":"Data Acquisition"},"content":{"rendered":"\n

Disk Acquisition Concept<\/strong><\/h2>\n\n\n\n

Data Acquisition<\/strong>
A process of imaging or otherwise obtaining information from a digital device and its peripheral equipment and media<\/p>\n\n\n\n


Image format<\/strong>
raw format: ex: output of dd
advanced forensics format: opensource format, like afk and afd
proprietary format: like e01 of encase format<\/p>\n\n\n\n

…<\/p>\n\n\n\n

Acquisition Method<\/strong>
Bit-stream disk copy
Sparse data copy
ps:
Bit-stream copy should always be performed first<\/p>\n\n\n\n

Bit-stream disk copy<\/strong>
to-image file, Most common method
ex: EnCase, FTK, SMART, Sleuth Kit, X-Ways, iLook, DD
to-disk
ex: SafeBack, SnapCopy, Norton Ghost 2002<\/p>\n\n\n\n

Sparse\/logical data copy<\/strong>
Creates exact copies of folders and files
Pros: it is good for large disks like 10 TB network data or specific file like email files
Cons:copy will not include deleted files, file slack and other information

refer
http:\/\/www.bk.psu.edu\/faculty\/bowers\/ist454\/PowerPoint\/Nelson\/ch09.pdf<\/p>\n\n\n\n


….<\/p>\n\n\n\n

Data acquisition mistakes<\/strong>
wrong solution
wrong cable
insufficient time
wrong connections
poor knowledge of the instrument<\/p>\n\n\n\n


\u9632\u6b62\u8cc7\u6599\u62bd\u53d6\u7684\u610f\u5916\u767c\u751f<\/strong>
1.\u8981\u6709\u9810\u9632\u610f\u5916\u7684\u8a08\u756b
2.\u70ba\u4e86\u4fdd\u5b58\u6578\u4f4d\u8b49\u64da,\u8981\u5c0d\u8b49\u64da\u8cc7\u6599\u505a\u5099\u4efd
3.\u5982\u679c\u6015\u7b2c\u4e00\u4efdco\u51fa\u4f86\u7684\u8cc7\u6599\u640d\u6bc0 \u9084\u53ef\u4ee5\u6709\u7b2c\u4e8c\u4efdcopy
4.\u4f7f\u7528\u81f3\u5c11\u5169\u7a2e\u62bd\u53d6\u5de5\u5177\u4e26\u6bd4\u5c0d\u62bd\u53d6\u7d50\u679c\u662f\u5426\u76f8\u540c
refer
http:\/\/wenku.baidu.com\/view\/da7fbcd0360cba1aa811da11.html?re=view<\/p>\n\n\n\n

…<\/p>\n\n\n\n

Type of data acquisition<\/strong>
static: hard disk
live: memory<\/p>\n\n\n\n

………………………………………………………………………………………………………….<\/p>\n\n\n\n

Disk Acquisition Tool Requirements<\/strong><\/h2>\n\n\n\n


Tool requirements<\/strong>
The tool should not change the original content \/Prevent Contamination.
The tool should log I\/O errors in an accessible and readable form, including the type and location of the error.
The tool must have the ability to be held up to scientific and peer review. 
The tool should compute a hash value for the complete bit stream copy generated from an image file of the source.
ex:
using a well-tested hardware write-blocking device to Prevent that the evidence drive is changed<\/p>\n\n\n\n

ps
hardware write blocker device<\/strong>
a devices that allow acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents.
the device is used to prevent the system from recording data on an evidence disk.
ex: write blockers,forensic bridges
refer
http:\/\/forensicswiki.org\/wiki\/Write_Blockers<\/p>\n\n\n\n

…<\/p>\n\n\n\n

Common Windows tool<\/strong>
AccessData FTK
DD for windows
Snapback exact
Snapshot
DatArrest
Safeback
Encase
R-Drive Image \u53ef\u4ee5\u5728\u4e0d\u505c\u4e0bWindows\u7684\u72c0\u614b\u4e0b\u5099\u4efd
Disk Explorer
drive spy<\/p>\n\n\n\n

accessdata FTK<\/strong>
support source: memory, registry, pyshical disk
ps: when it finish acquisiisiton, hash will be made
output image support: dd,afk, e01<\/p>\n\n\n\n

drive Spy<\/strong>
1.Savesect \u5c07disk\u8907\u88fd\u6210\u6a94\u6848
2.WriteSect \u5c07\u6a94\u6848\u5beb\u56dedisk
3.SavePart \u5c07\u7279\u5b9aPartition\u4f5c\u6210image
4.WritePart \u5c07image\u8cc7\u6599\u5beb\u56de<\/p>\n\n\n\n

refer
http:\/\/wenku.baidu.com\/view\/da7fbcd0360cba1aa811da11.html?re=view<\/p>\n\n\n\n

…………………………………………<\/p>\n\n\n\n

dd<\/strong>
convert and copy a file, linux build-in tool\u3000
supporting Bit-stream disk-to-image file
\u5e38\u898b\u53c3\u6578\uff1a
if :input file,\u8868\u793a\u6307\u5b9a\u8b80\u53d6\u4f86\u6e90
of : output file,\u8868\u793a\u6307\u5b9a\u5beb\u5165\u76ee\u7684
bs : block size,\u8868\u793a\u8b80\u5165\u8207\u5beb\u5165\u7684\u5927\u5c0f,\u9810\u8a2d\u4ee5byte\u70ba\u55ae\u4f4d. bs\u8d8a\u5927\u8655\u7406\u901f\u5ea6\u8d8a\u5feb
count : \u8868\u793a\u8655\u7406\u7684\u6b21\u6578
conv: \u8f49\u63db\u53c3\u6578,\u5e38\u898b\u7684\u6709\u4ee5\u4e0b
\u3000notrunc \u4e0d\u622a\u65b7\u8f38\u51fa\u6587\u4ef6
\u3000noerror \u767c\u751f\u8b80\u932f\u8aa4\u6642\uff0c\u7e7c\u7e8c\u9032\u884c
\u3000sync \u628a\u6bcf\u500b\u8f38\u5165\u8a18\u9304\u7684\u5927\u5c0f\u90fd\u8abf\u5230ibs\u7684\u5927\u5c0f(\u7528NUL\u586b\u5145)
\u5e38\u898b\u7528\u9014
Copy a partition to an image file<\/strong>
ex:
block\u70ba10m\u800c\u4e14\u8981\u986f\u793a\u9032\u5ea6
dd if=.d: of=demo.dd bs=10m –progress
ex:
\u6a94\u6848\u5927\u65bc650m\u5c31\u5207\u5272
dd if=\/dev\/sdb | split -b 650m -image_sdb
Copy the running memory to a file<\/strong>
ex:
\u5c07memory\u8907\u88fd\u5230men.bin
dd if=\/dev\/mem of=\/root\/mem.bin bs=1024
Restore a disk from an image file<\/strong>
ex:
dd if=\/usr\/home\/partition.image of=\/dev\/sda2 bs=4096<\/p>\n\n\n\n

ps:
fciv can make hash from file that is made by dd<\/p>\n\n\n\n

refer
http:\/\/nathan-inlinux.blogspot.tw\/2013\/05\/linux-dd.html
http:\/\/fanqiang.chinaunix.net\/a1\/b5\/20010917\/1200021305_b.html<\/p>\n\n\n\n

…<\/p>\n\n\n\n

ddfldd<\/strong>
\u9451\u8b58\u7b49\u7d1a\u7684DD\u5de5\u5177
\u53c3\u6578\u8207dd\u5dee\u4e0d\u591a
\u5e38\u7528\u53c3\u6578\u5982\u4e0b
\u3000vf: verify file
\u3000hash: \u9078\u64c7hash\u65b9\u5f0f
\u3000hashlog: log\u8a18\u9304\u4f4d\u7f6e
ex:
Bit-stream disk-to-image file with hash verification<\/strong>
ddfldd if=\/dev\/sda split=2m of=usbimg hash=md5 hashlog=usbhash.log
ex:
fill the disk with zeros<\/strong>
ddfldd if=\/dev\/zero of=\/dev\/sda bs=4096 conv=noerror,sync<\/p>\n\n\n\n

refer
http:\/\/blogger.gtwang.org\/2015\/01\/dd-command-examples.html<\/p>\n\n\n\n

…………………………………………………………………………………………………………………..<\/p>\n\n\n\n

Validation Methods<\/strong><\/h2>\n\n\n\n

Validating data acquisitions<\/strong>
hash is general method,
well-known hash is like md5,sha1
it is useful in before and after evidence examination<\/p>\n\n\n\n

A method of use hash<\/strong>
1.Make hashes of the evidence and compare it with the original hash that was taken
when the evidence first entered the lab
2.if someone suspects wheather evidence has been changed while at the lab, investigator can prove the evidence is the same as it was when it first entered the lab<\/p>\n","protected":false},"excerpt":{"rendered":"

Disk Acquisition Concept Data …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[11],"tags":[],"class_list":["post-361","post","type-post","status-publish","format-standard","hentry","category-forensics"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=361"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/361\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}