Diseño de producto / servicio

evidence remains unaltered and that the digital copy they are

working from is a true bit-by-bit representation of the original

media. A combination of hardware and software tools are

available to the examiner to complete this task in preparation

for analyzing the contents of the media.

I

n simple terms, forensic techniques involve the scientific collection, ex- amination and presentation of evidence in administrative, civil or criminal matters. By “scientific” I mean that the technologies used must be based on generally accepted standards, yielding reliable and repeatable results. As computer technology has become fully integrated into every facet of mod- ern society, digital artifacts are an ever-present and invaluable source of rel- evant information in these cases.

One of the key principles of Digital Forensics is that examiners must elimi- nate or minimize the risk of altering any information contained on the original evidence items. Where at all possible, the analyst will make digital copies of the media to be examined and work from these duplicates, preserving the originals. The analyst will utilize a hardware write-blocking device that pre- vents any date to be written to change on the original evidence media. In ad- dition, target media, that is the disk we copy the image to, will be the disk we, overwritten with all ones, zeroes or a random pattern to ensure no preexist- ing data on the target will be comingled with the subject data under scrutiny. This process is also known as “wiping” a drive. A wiping utility popular with both Digital Forensic examiners and PC Support technicians is “DBAN,” also available at no cost. [1]

The Digital Forensics examiner has numerous options for creating exact bit-stream representations of digital media, including hardware duplicators as well as various software tools that create digitally identical copies. In this ar- ticle I focus on the features and use of AccessData’s FTK Imager.

What you will learn:

• How to create digitally identical copies of hard drives and other storage media

• The importance of “write-blocking” • The concept of “hashes”

What you should know:

• How to remove a hard drive from a compute

• A basic familiarity with operating systems

• A basic familiarity with directory and file structures on hard drives

www.eForensicsMag.com 31

uSINg FTK IMAgER CREATE

FEATuRES

FTK Imager is probably the best known software application for creating bit-stream duplicates of digital media. It is provided as a free of charge download by AccessData in both an installable and portable version (FTK Imager Lite). Either version can be used to create forensic copies of entire hard drives (physical imaging), par- titions (logical drives), or selected folders and files (sparse imaging). Additionally, flash memory cards, USB drives, optical drives (CD/DVD) and Fernico devices (multiple-CD/DVD servers) may be duplicated, as well. Hashing of images and files is automatically performed using both MD5 and SHA1 algorithms.

At this point, I need to define t this po for the beginner practitioner. Hashing is the process of creating a fixed-length digital “is the process of creating a fixed-length digital opies of entire hthe fileprocess of cre- ating a fixedEven viewing a file using Explorer or some other utility will alter a file’ielast accessed date, which will, in turn, change the hash value of that file. In order to prevent unintended changes to a file’ In order or its er to pre, ”othe examiner utilizes either a hardware device or software utility to serve as a “ther a hardware device or software u [2]. In my practice, I prefer to use a hardware write-blocker to help ensure that I do not inadvertantly change the contents of the data under examination. I feel that software write-blocking utilities are too prone to mishap or forgetfulness.

A nice feature is that FTK Imager has the ability to convert between the most common forensic im- age formats, RAW, SMART, E01 and AFF. This can be very useful if you have a disk image in RAW (dd) format and need to share the image with, for example, an investigator who requests the image in E01 format for use with EnCase. For LINUX users, FTK Imager is also available in both 32- and 64-bit com- mand-line versions.

Other handy features of FTK Imager include the ability to perform a live acquisition of a computer’s RAM as well as obtain the Registry from Windows-based PCs. Depending on output format, images may be compressed or split, which makes copying the results to external media easier and more reliable.

A feature added to the newer versions of FTK Imager is the ability to mount forensic images as physical or logical drives in order to quickly search or preview contents. I have found this to be particularly help- ful when examining acquired images of Macintosh computers on Windows forensic workstations. Previ- ously, this required that the examiner obtain third-party mounting utilities at additional cost. Even without explicitly mounting an image as a physical or logical drive, adding the drive -or image- as an evidence item permits the examiner to scroll through the contents of the evidence using the built-in hexadecimal/ text viewer, another handy feature for previewing evidence.

lIMITATIONS

Although FTK Imager boasts an impressive list of features, all the more remarkable considering that it is free-ware; the application does have some limitations that an examiner needs to be aware of.

First, because it is a Windows-based product, FTK Imager cannot access any Host Protected Area (HPA) or Device Configuration Overlay (DCO) that may be present on a hard drive. If these areas are on a hard drive and you have a reasonable expectation that these may contain evidence, than you will need to utilize either a LINUX-based solution or a hardware disk duplicator.

Second, FTK Imager does not handle bad blocks well. If the number of bad blocks or unreadable sec- tors is significant, this application will slow to the point of being unusable. The read-ahead cache en- counters the errors and becomes unresponsive. In such cases, you will need to obtain a utility that can perform “reverse cloning” to bypass the drive cache and recover data.

Third, creating forensic duplicates of large capacity drives takes time. This is not a limitation of FTK Imager, but is endemic to all software imaging tools. In my experience it requires approximately 6 hours to duplicate a 250 gigabyte hard drive; a one terabyte drive needs roughly 24 hours to completely copy. Hardware duplicators will perform the task more quickly and may be the preferred option if speed is a re- quirement. Keep in mind also that creating the forensic drive image is just the beginning of the examina- tion process. Using applications such as AccessData’s Forensic Toolkit require at least an equal amount of time to carve and index the directories, files and deleted data within a drive image.

In document Nutricionistas 100% Online (página 91-0)