book

Practical Forensic Imaging

Name: Practical Forensic Imaging
Author: Bruce Nikkel
ISBN: 9781593277932

by Bruce Nikkel

September 2016

Intermediate to advanced

320 pages

8h 32m

English

No Starch Press

Read now

Unlock full access

Cover Page
Title Page
Copyright Page
Dedication
About the Author
Brief Contents
Contents in Detail
Foreword by Eoghan Casey
Introduction
Why I Wrote This BookHow This Book Is DifferentWhy Use the Command Line?Target Audience and PrerequisitesWho Should Read This Book?Prerequisite KnowledgePreinstalled Platform and SoftwareHow the Book Is OrganizedThe Scope of This BookConventions and Format
Chapter 0: Digital Forensics Overview
Digital Forensics HistoryPre-Y2K2000–20102010–PresentForensic Acquisition Trends and ChallengesShift in Size, Location, and Complexity of EvidenceMultijurisdictional AspectsIndustry, Academia, and Law Enforcement CollaborationPrinciples of Postmortem Computer ForensicsDigital Forensic StandardsPeer-Reviewed ResearchIndustry Regulations and Best PracticePrinciples Used in This Book

Chapter 1: Storage Media Overview
Magnetic Storage MediaHard DisksMagnetic TapesLegacy Magnetic StorageNon-Volatile MemorySolid State DrivesUSB Flash DrivesRemovable Memory CardsLegacy Non-Volatile MemoryOptical Storage MediaCompact DiscsDigital Versatile DiscsBlu-ray DiscsLegacy Optical StorageInterfaces and Physical ConnectorsSerial ATASerial Attached SCSI and Fibre ChannelNon-Volatile Memory ExpressUniversal Serial BusThunderboltLegacy InterfacesCommands, Protocols, and BridgesATA CommandsSCSI CommandsNVME CommandsBridging, Tunneling, and Pass-ThroughSpecial TopicsDCO and HPA Drive AreasDrive Service and Maintenance AreasUSB Attached SCSI ProtocolAdvanced Format 4KnNVME NamespacesSolid State Hybrid DisksClosing Thoughts
Chapter 2: Linux as a Forensic Acquisition Platform
Linux and OSS in a Forensic ContextAdvantages of Linux and OSS in Forensics LabsDisadvantages of Linux and OSS in Forensics LabsLinux Kernel and Storage DevicesKernel Device DetectionStorage Devices in /devOther Special DevicesLinux Kernel and FilesystemsKernel Filesystem SupportMounting Filesystems in LinuxAccessing Filesystems with Forensic ToolsLinux Distributions and ShellsLinux DistributionsThe ShellCommand ExecutionPiping and RedirectionClosing Thoughts
Chapter 3: Forensic Image Formats
Raw ImagesTraditional ddForensic dd VariantsData Recovery ToolsForensic FormatsEnCase EWFFTK SMARTAFFSquashFS as a Forensic Evidence ContainerSquashFS BackgroundSquashFS Forensic Evidence ContainersClosing Thoughts
Chapter 4: Planning and Preparation
Maintain an Audit TrailTask ManagementShell HistoryTerminal RecordersLinux AuditingOrganize Collected Evidence and Command OutputNaming Conventions for Files and DirectoriesScalable Examination Directory StructureSave Command Output with RedirectionAssess Acquisition Infrastructure LogisticsImage Sizes and Disk Space RequirementsFile CompressionSparse FilesReported File and Image SizesMoving and Copying Forensic ImagesEstimate Task Completion TimesPerformance and BottlenecksHeat and Environmental FactorsEstablish Forensic Write-Blocking ProtectionHardware Write BlockersSoftware Write BlockersLinux Forensic Boot CDsMedia with Physical Read-Only ModesClosing Thoughts
Chapter 5: Attaching Subject Media to an Acquisition Host
Examine Subject PC HardwarePhysical PC Examination and Disk RemovalSubject PC Hardware ReviewAttach Subject Disk to an Acquisition HostView Acquisition Host HardwareIdentify the Subject DriveQuery the Subject Disk for InformationDocument Device Identification DetailsQuery Disk Capabilities and Features with hdparmExtract SMART Data with smartctlEnable Access to Hidden SectorsRemove a DCORemove an HPADrive Service Area AccessATA Password Security and Self-Encrypting DrivesIdentify and Unlock ATA Password-Protected DisksIdentify and Unlock Opal Self-Encrypting DrivesEncrypted Flash Thumb DrivesAttach Removable MediaOptical Media DrivesMagnetic Tape DrivesMemory CardsAttach Other StorageApple Target Disk ModeNVME SSDsOther Devices with Block or Character AccessClosing Thoughts
Chapter 6: Forensic Image Acquisition
Acquire an Image with dd ToolsStandard Unix dd and GNU ddThe dcfldd and dc3dd ToolsAcquire an Image with Forensic FormatsThe ewfacquire ToolAccessData ftkimagerSquashFS Forensic Evidence ContainerAcquire an Image to Multiple DestinationsPreserve Digital Evidence with CryptographyBasic Cryptographic HashingHash WindowsSign an Image with PGP or S/MIMERFC-3161 TimestampingManage Drive Failure and ErrorsForensic Tool Error HandlingData Recovery ToolsSMART and Kernel ErrorsOther Options for Failed DrivesDamaged Optical DiscsImage Acquisition over a NetworkRemote Forensic Imaging with rddSecure Remote Imaging with sshRemote Acquisition to a SquashFS Evidence ContainerAcquire a Remote Disk to EnCase or FTK FormatLive Imaging with Copy-On-Write SnapshotsAcquire Removable MediaMemory CardsOptical DiscsMagnetic TapesRAID and Multidisk SystemsProprietary RAID AcquisitionJBOD and RAID-0 Striped DisksMicrosoft Dynamic DisksRAID-1 Mirrored DisksLinux RAID-5Closing Thoughts
Chapter 7: Forensic Image Management
Manage Image CompressionStandard Linux Compression ToolsEnCase EWF Compressed FormatFTK SMART Compressed FormatAFFlib Built-In CompressionSquashFS Compressed Evidence ContainersManage Split ImagesThe GNU split CommandSplit Images During AcquisitionAccess a Set of Split Image FilesReassemble a Split ImageVerify the Integrity of a Forensic ImageVerify the Hash Taken During AcquisitionRecalculate the Hash of a Forensic ImageCryptographic Hashes of Split Raw ImagesIdentify Mismatched Hash WindowsVerify Signature and TimestampConvert Between Image FormatsConvert from Raw ImagesConvert from EnCase/E01 FormatConvert from FTK FormatConvert from AFF FormatSecure an Image with EncryptionGPG EncryptionOpenSSL EncryptionForensic Format Built-In EncryptionGeneral Purpose Disk EncryptionDisk Cloning and DuplicationPrepare a Clone DiskUse HPA to Replicate Sector SizeWrite an Image File to a Clone DiskImage Transfer and StorageWrite to Removable MediaInexpensive Disks for Storage and TransferPerform Large Network TransfersSecure Wiping and Data DisposalDispose of Individual FilesSecure Wipe a Storage DeviceIssue ATA Security Erase Unit CommandsDestroy Encrypted Disk KeysClosing Thoughts
Chapter 8: Special Image Access Topics
Forensically Acquired Image FilesRaw Image Files with Loop DevicesForensic Format Image FilesPrepare Boot Images with xmountVM ImagesQEMU QCOW2VirtualBox VDIVMWare VMDKMicrosoft VHDOS-Encrypted FilesystemsMicrosoft BitLockerApple FileVaultLinux LUKSTrueCrypt and VeraCryptClosing Thoughts
Chapter 9: Extracting Subsets of Forensic Images
Assess Partition Layout and FilesystemsPartition SchemePartition TablesFilesystem IdentificationPartition ExtractionExtract Individual PartitionsFind and Extract Deleted PartitionsIdentify and Extract Inter-Partition GapsExtract HPA and DCO Sector RangesOther Piecewise Data ExtractionExtract Filesystem Slack SpaceExtract Filesystem Unallocated BlocksManual Extraction Using OffsetsClosing Thoughts
Closing Remarks
Index
Updates
“An indispensible reference for anyone responsible for preserving digital evidence.” —Professor Eoghan Casey, University of Lausanne
Footnotes
Chapter 0: Digital Forensics OverviewChapter 1: Storage Media OverviewChapter 2: Linux as a Forensic Acquisition PlatformChapter 3: Forensic Image FormatsChapter 4: Planning and PreparationChapter 5: Attaching Subject Media to an Acquisition HostChapter 6: Forensic Image AcquisitionChapter 7: Forensic Image ManagementChapter 8: Special Image Access Topics

Content preview from Practical Forensic Imaging

9EXTRACTING SUBSETS OF FORENSIC IMAGES

This chapter covers the selective extraction of data regions from an attached drive or a forensically acquired image file. You’ll learn to extract whole partitions, deleted or partially overwritten partitions, inter-partition gaps, and various volume and file slack areas. In addition, you’ll see how to extract special areas such as Unified Extensible Firmware Interface (UEFI) partitions, the sectors hidden by a DCO or HPA, and hibernation partitions such as Intel Rapid Start Technology.

The final sections demonstrate extraction of data from allocated and unallocated (possibly deleted) areas of the disk for ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781492018049Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Practical Forensic Imaging

by Bruce Nikkel

9EXTRACTING SUBSETS OF FORENSIC IMAGES

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.