Discussion on:

Message 10 of 20
0 Votes
+ -
Been there, done that.
There's this wonderful godawful expensive tool called EnCase from Guidance software. Typically at least $3K + annual support fees for one copy.
http://www.guidancesoftware.com/ediscovery.htm

It's not rocket science, you connect the hard drive to a write-blocker and use a tool like EnCase or DD to image the drive.

EnCase, like many commercial software tools, does the work for you. There are lots of great open source forensics tools (autopsy, sleuth, etc) that all basically start with grabbing a copy of the drive with DD and then let you go to town on the copy.

http://www.sleuthkit.org/
http://wiki.sleuthkit.org/index.php?title=Main_Page

Of course, the difference is that the free/open source apps typically do fewer things auto-magically, so you need to do more work to do the same job.

I won't go into the whole evidence-capture procedure, but it's critical not only that you use a write-blocker, but that you follow and document every step of the procedure, or the evidence will be thrown out of court faster than an old man in a girls locker room.
Posted by robo_dev
11th Oct 2011