Practical Windows Forensics

Chapter 4. Nonvolatile Data Acquisition

In this chapter, we will discuss the acquisition of Hard Disk Drives or HDD. Data acquisition is critical because performing analysis on the original hard drive may cause failure on the only hard drive that contains the data or you may write to that original hard drive by mistake.

So, creating a forensics image from the hard drive must be performed prior to the analysis. The acquisition of the HDD can be either conducted at the incident scene or in the analysis lab, on a live or a powered off system, and over network or locally, as we will see in this chapter.

In a nutshell, we will cover the following topics:

• Forensic image
• Incident response CDs
• Live imaging of a hard drive
• Linux for the imaging of a hard drive ...