Digital Forensics

  1. Evidence Collection and Preservation (Acquisition)
    1. Preparing for Acquisition
      1. Assembling the Forensic Toolkit
        1. Hardware Tools
          1. Write Blockers
            1. Imaging Devices
              1. Cables and Adapters
                1. Storage Media
                2. Software Tools
                  1. Imaging Software
                    1. Analysis Tools
                      1. Validation Utilities
                      2. Documentation Supplies
                        1. Forms and Templates
                          1. Photography Equipment
                            1. Labeling Materials
                          2. Documenting the Scene
                            1. Photographing and Sketching
                              1. Overall Scene Documentation
                                1. Device-Specific Photography
                                  1. Connection Diagrams
                                  2. Noting System State and Connections
                                    1. Power Status
                                      1. Network Connections
                                        1. Peripheral Devices
                                          1. Screen Contents
                                        2. Establishing a Secure Environment
                                          1. Isolating Devices from Networks
                                            1. Physical Disconnection
                                              1. Faraday Bags
                                                1. Signal Blocking
                                                2. Preventing Remote Access or Tampering
                                                  1. Access Control
                                                    1. Monitoring
                                                      1. Environmental Security
                                                  2. Data Acquisition Types
                                                    1. Live Acquisition (Volatile Data)
                                                      1. Capturing RAM
                                                        1. Memory Dump Tools
                                                          1. Hibernation Files
                                                            1. Page Files
                                                            2. Capturing Network Connections
                                                              1. Active Connections
                                                                1. Listening Ports
                                                                  1. Network Statistics
                                                                  2. Capturing Running Processes
                                                                    1. Process Lists
                                                                      1. Process Memory
                                                                        1. Loaded Modules
                                                                        2. System State Information
                                                                          1. Registry Contents
                                                                            1. Environment Variables
                                                                              1. Temporary Files
                                                                            2. Dead Acquisition (Static Data)
                                                                              1. Imaging Powered-Off Devices
                                                                                1. Cold Boot Procedures
                                                                                  1. BIOS/UEFI Considerations
                                                                                  2. Collecting Storage Media
                                                                                    1. Hard Drives
                                                                                      1. Solid State Drives
                                                                                        1. Optical Media
                                                                                          1. Flash Memory
                                                                                      2. Acquisition Methods
                                                                                        1. Disk-to-Image
                                                                                          1. Full Physical Imaging
                                                                                            1. Sector-by-Sector Copy
                                                                                              1. Bad Sector Handling
                                                                                                1. Compression Options
                                                                                              2. Disk-to-Disk
                                                                                                1. Cloning Drives
                                                                                                  1. Hardware Cloning
                                                                                                    1. Software Cloning
                                                                                                      1. Verification Procedures
                                                                                                    2. Logical Acquisition
                                                                                                      1. Extracting File System Data
                                                                                                        1. File-Level Copying
                                                                                                          1. Directory Structure Preservation
                                                                                                          2. Targeted Data Collection
                                                                                                            1. Selective File Types
                                                                                                              1. Date Range Filtering
                                                                                                                1. Keyword-Based Selection
                                                                                                              2. Sparse Acquisition
                                                                                                                1. Selective Imaging of Relevant Data
                                                                                                                  1. Allocated Space Only
                                                                                                                    1. Specific Partitions
                                                                                                                      1. File System Metadata
                                                                                                                  2. Forensic Imaging
                                                                                                                    1. Creating a Bit-Stream Copy
                                                                                                                      1. Ensuring Data Completeness
                                                                                                                        1. Error Handling
                                                                                                                          1. Progress Monitoring
                                                                                                                          2. Forensic Image Formats
                                                                                                                            1. Raw (dd)
                                                                                                                              1. Characteristics and Use Cases
                                                                                                                                1. Advantages and Limitations
                                                                                                                                  1. Tool Compatibility
                                                                                                                                  2. EnCase (E01)
                                                                                                                                    1. Features and Metadata
                                                                                                                                      1. Compression Support
                                                                                                                                        1. Error Recovery
                                                                                                                                        2. AccessData (AD1)
                                                                                                                                          1. Compatibility and Limitations
                                                                                                                                            1. Proprietary Features
                                                                                                                                            2. Advanced Forensics Format (AFF)
                                                                                                                                              1. Compression and Encryption Support
                                                                                                                                                1. Metadata Capabilities
                                                                                                                                                  1. Open Source Nature
                                                                                                                                                  2. Expert Witness Format (EWF)
                                                                                                                                                    1. SMART Format
                                                                                                                                                    2. Image Splitting and Spanning
                                                                                                                                                      1. Size Limitations
                                                                                                                                                        1. Media Spanning
                                                                                                                                                          1. Reconstruction Procedures
                                                                                                                                                        2. Validating Forensic Data
                                                                                                                                                          1. Hashing Algorithms
                                                                                                                                                            1. MD5
                                                                                                                                                              1. Strengths and Weaknesses
                                                                                                                                                                1. Collision Vulnerabilities
                                                                                                                                                                  1. Legacy Use Cases
                                                                                                                                                                  2. SHA-1
                                                                                                                                                                    1. Deprecation and Security Concerns
                                                                                                                                                                      1. Transition Considerations
                                                                                                                                                                      2. SHA-256
                                                                                                                                                                        1. Current Best Practices
                                                                                                                                                                          1. Performance Considerations
                                                                                                                                                                            1. Security Strength
                                                                                                                                                                            2. SHA-3
                                                                                                                                                                              1. Blake2
                                                                                                                                                                              2. Verifying Image Integrity
                                                                                                                                                                                1. Comparing Hash Values
                                                                                                                                                                                  1. Block-Level Verification
                                                                                                                                                                                    1. Documenting Validation Results
                                                                                                                                                                                      1. Re-verification Procedures
                                                                                                                                                                                      2. Digital Signatures
                                                                                                                                                                                        1. PKI Infrastructure
                                                                                                                                                                                          1. Certificate Validation
                                                                                                                                                                                            1. Timestamp Services
                                                                                                                                                                                          2. Hardware and Software Write Blockers
                                                                                                                                                                                            1. Role and Function
                                                                                                                                                                                              1. Preventing Data Modification
                                                                                                                                                                                                1. Read-Only Access
                                                                                                                                                                                                  1. Command Filtering
                                                                                                                                                                                                  2. Types of Write Blockers
                                                                                                                                                                                                    1. Hardware Write Blockers
                                                                                                                                                                                                      1. SATA/IDE Blockers
                                                                                                                                                                                                        1. USB Blockers
                                                                                                                                                                                                          1. FireWire Blockers
                                                                                                                                                                                                            1. Network Blockers
                                                                                                                                                                                                            2. Software Write Blockers
                                                                                                                                                                                                              1. Operating System Level
                                                                                                                                                                                                                1. Driver-Based Solutions
                                                                                                                                                                                                                  1. Virtual Machine Integration
                                                                                                                                                                                                                2. Testing and Verification of Write Blockers
                                                                                                                                                                                                                  1. NIST Testing Procedures
                                                                                                                                                                                                                    1. Validation Protocols
                                                                                                                                                                                                                      1. Performance Testing
                                                                                                                                                                                                                        1. Compatibility Testing

                                                                                                                                                                                                                    Previous

                                                                                                                                                                                                                    1. Foundations of Digital Forensics

                                                                                                                                                                                                                    Go to top

                                                                                                                                                                                                                    Next

                                                                                                                                                                                                                    3. Computer Forensics