Hardware

Ask something
Question Locked

Forensic Backup

0 helpful
4 replies

by jarrett

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I was recently asked to provide an evidentiary hard drive backup for a law firm. At first, I agreed without hesitation but then I began to worry. I was simply going to use a program like Arconis True Image to plug in the drive to my rig and do a drive to drive copy. However, I began to wonder if this would truly provide a "forensic" copy of the drive given that by plugging it in to my computer I would be accessing the drive, however slightly. Is there a true blue forensic method or is a simple disc clone/image the same? Does anyone have a recommendation for a good all-around solution for this kind of operation?

4 replies

by older mycroft

Since the intrinsic nature of a forensic examination would be to 'Apply' it.

Any clone, no matter how good a copy, will still only be a copy. I seriously doubt if a Court of Law would accept a copy given into evidence!

[u]Afterthought:[/u]

I've never heard of a Subpoena being issued for a copy of anything.

By the same token, I've never heard of someone wanting a clone of an original BEFORE a Subpoena has been issued!

...I believe it is usually called "Tampering With Evidence".

by oh smeg

So that the Original can placed into Evidence and allow the place to continue to function while the Original Drive is Subject to Forensic Investigation. But that will not work either as the original Drive gets trashed in the process.

If thats is the case a simple clone or whatever you prefer to use will be quite OK. However if they are expecting you to provide a [b]Full Forensic Backup[/b] it's not that easy as you need to perform a complete Forensic Scan and backup the total output to 2 different drives. This could only be used for Internal work as well as there is no proof that this is a True & Correct Copy unless it is done under Court Appointed Supervision and you are Accredited by the Court to do this type of work with a Court Order to do it.

I've never heard of anything being requested as a Forensic Copy as this is done by Authorised People/Companies appointed by the Courts. Generally a State Department is the one who does this type of work as they are the ones who are accredited to do it by the Courts.

Col

by ic-it

Gnosis18 found in this thread?
http://www.computing.net/security/wwwboard/forum/22060.html

If so the main problem is that the other user is still using their machine.
Forensically you would want to make a bit stream or bit by bit copy of the drive. At the time you would need to make a hash of the drive and of the image to document the fact that it was not altered. This will change if they are still using it.
If two images were made and the drive replaced, then the drive could be isolated and a chain of custody established. One image could go on a new drive to allow the user to continue working. The next image could either be placed on a sterile drive and examined or the entire bit stream could be examined using forensic tools like En-Case or FTK.
For a non-evidentuary examination you could restore the image to the sterile drive and examine it for whatever. But that drive itself could not be used as an untampered evidence item. (You still have the hashed image though).
Edited to add: The linux command DD can be used or in your case Ghost or another bit by bit copier.

This discussion is closed to new replies.