Chapter 4 Data Acquisition.pdf

《Chapter 4 Data Acquisition.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、9-24-2008Objectives•ListdigitalevidencestorageformatsGuidetoComputerForensics•ExplainwaystodeterminethebestacquisitionandInvestigationsmethodThirdEditionThirdEdition•Describecontingencyplanningfordataacquisitions•ExplainhowtouseacquisitiontoolsChapter4DataAcquisition

2、GuidetoComputerForensicsandInvestigations2UnderstandingStorageFormatsforObjectives(continued)DigitalEvidence•Explainhowtovalidatedataacquisitions•Threeformats•DescribeRAIDacquisitionmethods–Rawformat•Explainhowtouseremotenetworkacquisition–Proprietaryformatstools–Adv

3、ancedForensicsFormat(AFF)•ListotherforensictoolsavailablefordataacquisitionsGuidetoComputerForensicsandInvestigations3GuidetoComputerForensicsandInvestigations4RawFormatProprietaryFormats•Makesitpossibletowritebit-streamdatatofiles•Featuresoffered•Advantages–Optionto

4、compressornotcompressimagefiles–Fastdatatransfers–Cansplitanimageintosmallersegmentedfiles–Canignoreminordatareaderrorsonsourcedrive–Canintegratemetadataintotheimagefile–Mostcomputerforensicstoolscanreadrawformat•Disadvantages•Disadvantages–Inabilitytoshareanimagebet

5、weendifferenttools–Requiresasmuchstorageasoriginaldiskordata–Filesizelimitationforeachsegmentedvolume–Toolsmightnotcollectmarginal(bad)sectorsGuidetoComputerForensicsandInvestigations5GuidetoComputerForensicsandInvestigations619-24-2008AdvancedForensicsFormatAdvanced

6、ForensicsFormat(continued)•DevelopedbyDr.SimsonL.GarfinkelofBasis•Designgoals(continued)TechnologyCorporation–Internalconsistencychecksforself-authentication•Designgoals•Fileextensionsinclude.afdforsegmentedimage–Providecompressedoruncompressedimagefilesfilesand.afmf

7、orAFFmetadata–Nosizerestrictionfordisk-to-imagefiles•AFFisopensource–Providespaceintheimagefileorsegmentedfilesformetadata–Simpledesignwithextensibility–OpensourceformultipleplatformsandOSsGuidetoComputerForensicsandInvestigations7GuidetoComputerForensicsandInvestiga

8、tions8DeterminingtheBestAcquisitionDeterminingtheBestAcquisitionMethodMethod(continued)•Typesofacquisitions•Bit-streamdisk-to-image