Hi and welcome to our next section.
Acquiring forensic images in this section we introduce some fundamental concepts about forensic imaging
and then cover to command line tools DCF Beldi and DC 3D and a graphical user interface program.
Guy maigre designed to acquire forensic images.
Now we move onto the first video of the section that deals with a brief introduction to forensic imaging.
In this video we explain hardware and software right blocking techniques.
The various forensic image formats and hard disk physical structure and geometry together with special
features that are relevant for digital forensics.
Mainly the device configuration orderly and their host protected area forensic image acquisition can
be defined as the process of acquiring a forensically sound copy or image of the device or media to
analyze the image shall be forensically sound that is will be able to verify that it's really an exact
copy of the original and that the procedure to acquire it is well documented.
The forensic imaging phase is very important in the digital forensic process because the acquired image
file is the basis from which examiners extract and analyze data to find the evidence.
So if the image is not acquired correctly all the subsequent work is in vain.
Typically speaking a forensic image is a bit by bit copy of the media to acquire it differs from a single
clone of the file system as it's a copy of all the rural sectors of the disk or partition when acquiring
an image.
It must be ensured that no rights are made at all to the original media.
Moreover we must use cryptographic caching to verify the integrity of the image and any input output
errors must be logged as prescribed by the newest computer forensic tool testing program before collecting
any drives or media to be analyzed.
It's a good practice to take photos and notes about them as well as the scene and suspects computer
in this and the following video we refer to imaging of a hard disk.
We refer to the imaging of a hard disk as it still the most common case when dealing with desktop computers
and laptops.
There are basically two scenarios when it comes to acquiring a forensic image.
The first is when the hard drive is not removed and second is when removed from the suspect's computer
in the first case which has a beautiful example when a hard drive could not be physically removed or
during incident response we must use a forensic Live-CD like Linux to acquire an image a live CD shall
be booted to the so-called forensic mode that prevents the OS from automatically mounting any attached
drives and does not make use of the swap partition when booting.
If you want more information about the Kalli Linux forensic mode refer to the official documentation
on the Kallie Linux web site.
In the second case when their drive is being removed we must physically attach it to the forensic workstation
using a right blocking mechanism right blocking mechanisms could be implemented both in hardware and
software hardware right blockers are devices used to connect the drive to the forensic workstation that
that block any right attempts from the operating system to the drive.
We could have various types of connectors to deal with different types of drives hardware and blockers
are usually quite expensive but their use is recommended because they're more reliable than software
write block techniques.
An example of the hardware right block is shown in this photo with a hard disk attached through the
Satta connector software right blogging is quite a controversial topic indeed simply mounting a drive
on Linux as read only does not guarantee against possible writes that kernel drivers could make to the
device that kernel drivers could make to the device to solve this issue.
Various techniques have been developed.
The most effective one seems the most effective one is a solution based on a kernel patch that blocks
the write commands issued to the drive and the device driver level.
So at the software lowest level as it's a kernel patch The drawback is that we have to recompile the
kernel to apply it.
For more information about this patch refer to the link on get hub.
We've seen that in the image acquisition process.
All the bytes of a disk are copied into an image file.
There are different forensic image file formats most common in an open source forensics is the raw image.
That is a mere duplicate of all sectors of a hard disk.
Raw images contain no additional metadata apart from most of the file systems unlike the other forensic
formats.
We're going to use this format during the course.
Raw images can be obtained with tools like Deedy data dump which copy stream of bytes from the input
source drive to the output destination file.
The limitation of DD is the limitation of DD is it lacks certain features that are required for forensics
such as cryptographic caching and error handling cryptographic caching error handling and logging in
the next video we're going to see some variants of DD specifically designed for forensics another open
source forensic format is the advanced forensic format created by Garfinkel.
This format supports compression and encryption of the images and a software package called a f f lib.
It's been developed to convert and manage AFFO images.
There are also proprietary formats.
Most important are the expert witness format used by software and case and smart used by T.K. both support
compression and encryption of images and about the expert witness format.
An open source library and related tools have been created to cover and manage DWF images before proceeding
into the hands on part.
It's useful to recall the hard disk physical and logical addressing hard disk is formed by various platters
each having two heads each having two heads that read and write data on its sides.
Each side is subdivided into many constructs circular strips called tracks all the corresponding tracks
aligned through the stack of platters form a cylinder.
Each track is subdivided into units called sectors.
A sector is the smallest addressable disk unit traditionally sector size is 512 bytes.
But newer disks have moved to the advanced format for k n where the sector size is 4000 bytes though
still providing 512 bytes sector emulation.
Traditionally physical blocks or sectors are located using the cylinder head sector addressing scheme.
Though it's now outdated and replaced by logical block addressing it still used to specify the hard
disk geometry logical block addressing scheme is a linear addressing scheme where sectors are located
by 48 bits.
Integer indexes integer indexes.
There's also a formula to convert the C-H s addresses to LBA addresses in this picture we could see
an example of why a disk geometry specified in cylinder head sector together with the number of LBA
sectors available.
There are two features that are unknown to the majority of the users but are very important for a digital
investigation.
The device configuration overlay and host protected area device configuration overlay was introduced
in the basic standard to allow vendors to configure reported disk capacity and features host protected
area was introduced in a for standard to hide certain portions of the disk to an operating system and
reserve them to store for example recovery data and so on recovery data and so on while designed and
used for legitimate purposes.
These features have also been abused to store and hide malware and any kind of illicit data both device
configuration overlay and home protected area could be detected and removed.
Using a tool called HD parm.
Now we're going to briefly show it's usage.
Suppose that the target disk has been attached to the forensic workstation on Linux hard disks identified
by block device files under the dev directory in the format for example slash dev slash SDH X SDD SDC
etc..
Suppose our disk is identified by STA 1 to have more information about the disk.
We can run the command HD par
in it.
We could see information like the model number serial number firmware revision number of cylinders heads
and sectors.
Also the LBA user addressable sectors and scrolling down the device configuration overlay feature set
to see more info on device configuration overlay.
We can use the command
it shows for example the whole protected area is set on the disk.
There's another option of HD parm tool that allow us to see more information about the whole protected
areas set about the host protected areas set on the disk.
And it's the an option hashtag HD parm dash n slash dev slash sta.
We could see that the most protected area is enabled on the disk and the first number is the maximum
number of sectors that are visible to the operating system.
While the second number is the total real number of sectors on the disk.
So the difference between the two numbers are the number of sectors that are held between the operating
system.
And so to the user but are used to store our kind of data to remove the hosted protected area we can
issue the command with the same option and followed by the total number of sectors of the disk and this
command is the set the total number of sectors available to the operating system to be real total number
of sectors and so disabling the whole protected area and allowing us to acquire the total real numbers
of sectors.
The total real number of sectors that is the full capacity of the disk.
So we tied the total number of sectors here
to make this change permanent to the reboot.
We must prepend the number with letter P.
Now we could see in the output that the number of sectors visible to the OS is equal to the number of
real sectors available in the disk and the most protected area has been disabled in this video we've
talked about the fundamentals of forensic imaging covered the topic such as hardware and software right
blocking a forensic image formats disk geometry and its special features D.S.O. and HIPAA and how to
practically remove them.
Very good.
In the next video we're going to introduce two command line tools specifically designed for forensic
acquisition DCF Ltd..
See 3D.