Instructor: Disk image acquisition. 2 2
In the last lesson, we talked about collecting live memory. 3 3
In this lesson, 4 4
we're going to move down the order of volatility 5 5
and talk about collecting disk images. 6 6
When you conduct a disk image acquisition, 7 7
you're going to use a process 8 8
that creates an image file of the system's disks, 9 9
and these can then be analyzed to identify 10 10
current, deleted, and hidden files on a given disk. 11 11
Now notice, I didn't say hard drive. 12 12
This is because when we talk about this, 13 13
we can do this on any kind of disk. 14 14
It can be on a hard drive, a solid state drive, 15 15
or a USB thumb drive. 16 16
You can even do this on something 17 17
like an old school floppy disk drive or a tape backup drive. 18 18
Any kind of magnetic or electronic media can be done 19 19
through this disk image process. 20 20
Now, when we go to perform our disk image acquisition, 21 21
there are three different choices we have. 22 22
We can do a live acquisition, 23 23
a static acquisition by shutting the computer down, 24 24
or a static acquisition by pulling the plug. 25 25
Each of these has benefits and drawbacks, 26 26
and we're going to cover them all in this lesson. 27 27
Now, when we talk about live acquisition, 28 28
this is capturing the contents of the disk drive 29 29
while the computer is still running. 30 30
Just like I talked about with memory, 31 31
where we do a live acquisition of the memory 32 32
before we shut down the computer 33 33
because we would lose that contents in memory, 34 34
well sometimes, 35 35
you have to do a live acquisition of your disk. 36 36
For example, if the disk is encrypted 37 37
and you don't have the encryption key, 38 38
but you're lucky enough to catch that system 39 39
while it was still logged in, 40 40
that disk is currently unencrypted, 41 41
and so you can go in and capture it right now 42 42
doing a live acquisition. 43 43
Now, one of the challenges with a live acquisition 44 44
is that while you're capturing data, 45 45
the contents of the drive 46 46
could be changed during acquisition. 47 47
For example, maybe you're on the scene 48 48
trying to collect information off a computer, 49 49
but the person who owns that computer 50 50
is logged in remotely and sees you doing it, 51 51
and they start deleting files 52 52
while you're trying to copy those files. 53 53
This is what we're talking about 54 54
when we talk about the contents 55 55
of the drive could be changed, 56 56
and so live acquisition does have its benefits, 57 57
but it also has its drawbacks. 58 58
The next one we have is static acquisition 59 59
by shutting down. 60 60
Now, this is when the computer 61 61
is actually going to be shut down through the operating system, 62 62
and you do this properly, 63 63
and then the disk becomes acquired 64 64
outside of the operating system. 65 65
Now, for instance, if you're in Windows, 66 66
you go to the start menu and you tell it to shut down, 67 67
you wait for the computer 68 68
to nice and quietly shut itself down, powers off, 69 69
and then you could pull the hard drive out of the machine, 70 70
hook it up to an imaging terminal, 71 71
and then do your image that way. 72 72
Now, there are benefits and drawbacks to this as well. 73 73
Some malware can actually detect the shutdown, 74 74
and they'll perform anti-forensics, 75 75
like encrypting the files, like shuffling up the data, 76 76
like deleting things or overriding things, 77 77
and so this is something you do have to be worried about. 78 78
Next, we have static acquisition by pulling the plug. 79 79
This is going to occur 80 80
by taking the system's power and disconnecting it 81 81
by removing the power plug from the wall socket. 82 82
Essentially, you're just unplugging the computer. 83 83
Now, there's some benefits to doing this. 84 84
Unlike live acquisition, nobody can be changing files, 85 85
if you unplug the machine immediately, 86 86
and unlike shutting down a computer, 87 87
malware doesn't have a chance 88 88
to try to delete files or cover up its tracks. 89 89
Instead, you capture it right in the state it is in. 90 90
But, there's a downside to this too. 91 91
There is a risk that you can corrupt the data, 92 92
but it's also more likely that you're going to be able 93 93
to preserve the storage device's contents. 94 94
So which of these three should you perform, 95 95
that's really the question. 96 96
Well, if you have time at the scene, 97 97
you may decide to perform a live acquisition 98 98
and then one of the two types of static acquisitions. 99 99
This way, you can get the best of both worlds. 100 100
Now, there are two types of acquisitions 101 101
when I mention the word acquisition. 102 102
I can do a physical acquisition, 103 103
or I can do a logical acquisition. 104 104
Now, when I talk about a physical acquisition, 105 105
this is a bit-by-bit copy of the disk. 106 106
This includes every non-bad sector on that target disk, 107 107
including any deleted files or hidden data. 108 108
Anything that's on that hard drive 109 109
or that solid state drive or that USB drive 110 110
is going to be copied doing this, 111 111
and that's a great thing about doing a physical acquisition. 112 112
Now, the downside is it takes awhile to do one of these 113 113
because you're copying a bit-by-bit 114 114
of every single thing on that disk. 115 115
For instance, the computer I'm recording this on right now 116 116
has a one terabyte hard drive. 117 117
That computer, if you were going to do a bit-by-bit copy, 118 118
would take you several hours to make that copy. 119 119
Whereas, if I had only maybe 50 120 120
or 100 gigabytes stored on that computer, 121 121
you'd only have to copy the 50 or 100 gigabytes, 122 122
if you go and do it the other way, 123 123
which is a logical acquisition. 124 124
This way, you're not copying all that storage space, 125 125
you're only copying the files. 126 126
Logical acquisition is going to copy 127 127
your files and folders from partitions 128 128
using the file system table that's stored on the media. 129 129
Now, the good thing about this is it's a lot faster to copy, 130 130
but the bad thing is any files that were marked as deleted 131 131
are going to be missed. 132 132
Now, this brings us to an important concept, 133 133
which is file deletion. 134 134
Did you know that when you delete a file, 135 135
it's not really gone? 136 136
All you're doing is removing the marker from the table 137 137
that points to that file. 138 138
So if you think about it like a book, 139 139
you have a book with 10 chapters in it, 140 140
and you go to the first couple pages 141 141
and you find the table of contents and it says, 142 142
"If you want to read chapter 10, go to page 85," 143 143
and you then flip over to page 85, 144 144
and you start reading chapter 10. 145 145
Well, our file systems and hard drives 146 146
work the exact same way. 147 147
When you want to look at this video file, for instance, 148 148
you're connecting to my server, 149 149
and my server goes on its hard drive and says, 150 150
"You want video file number 123," 151 151
and it knows that's located in this spot on the hard drive. 152 152
It pulls it, and then gives it to you to read. 153 153
Now, if I deleted that marker that says, 154 154
"Here's where it's located," 155 155
the file's still on the hard drive, 156 156
you just don't have any way to access it. 157 157
And that's exactly what happens 158 158
when we start marking files for deletion. 159 159
We're going to talk more about this in a future lesson, 160 160
when we talk about data carving, but for now, 161 161
just remember that when you delete something, 162 162
it's not truly gone. 163 163
The next major idea we need to talk about 164 164
in disk acquisition is write blockers. 165 165
Now a write blocker is a forensic tool 166 166
that prevents the capture or analysis device or workstation 167 167
from changing any data on the target disk or media. 168 168
What does this mean? 169 169
Well, if I took your hard drive 170 170
and simply plugged it into my computer using a USB drive, 171 171
I could then read and write data to that drive, 172 172
and that'd be bad 173 173
because if you had the evidence on that drive, 174 174
I might write over it. 175 175
So we want to make sure we block the ability to write, 176 176
and that's what a write blocker does. 177 177
Now, write blockers can be either dedicated hardware 178 178
or a software-based solution. 179 179
It depends on what you're going to use. 180 180
If you're working as a forensics professional though, 181 181
you are almost always going to use a hardware solution 182 182
because they're foolproof and they work every single time. 183 183
Some of the software-based solutions, 184 184
they could be circumvented 185 185
with the appropriate tools and technology, 186 186
and so this is why a lot of people 187 187
like to rely on hardware-based write blockers 188 188
in the forensics community. 189 189
So, what does a hardware write blocker look like? 190 190
Well, this is one that I personally have. 191 191
This is my forensic USB bridge. 192 192
Now, if I was going to connect your USB thumb drive 193 193
or your USB hard drive to my computer, 194 194
I would plug it into this bridge on one side, 195 195
and then from this bridge, I would plug it into my computer. 196 196
That way, everything that goes 197 197
from your drive to my computer goes through this bridge. 198 198
That allows me to read the data from your drive, 199 199
but it blocks anything from going back onto your hard drive. 200 200
This prevents me from changing anything on that hard disk, 201 201
it becomes read only, essentially. 202 202
This particular forensic bridge or write blocker 203 203
is used whenever you're trying to access data 204 204
off a hard drive onto a given workstation. 205 205
But sometimes, you don't even need a workstation, 206 206
if you're just trying to do imaging, 207 207
which is what we're talking about here. 208 208
And so for that, 209 209
you can have dedicated machines 210 210
that will do this imaging for you. 211 211
You can have a forensic disk imager, like this one. 212 212
Now again, this is made by Tableau, 213 213
and Tableau is a very popular hardware manufacturer 214 214
for the forensic market. 215 215
Notice here, we have a hard drive that we're collecting on. 216 216
We plug it in to our device, 217 217
which then copies that and creates the image file 218 218
for us bit-by-bit doing a physical acquisition of the drive 219 219
using a static acquisition. 220 220
Once it's done, 221 221
that image file will be in this device, 222 222
and we can then upload it to our forensic server, 223 223
and then we can go through and do our analysis later on 224 224
with our forensic workstation. 225 225
Now, this brings us to the idea of imaging utilities. 226 226
If I was going to use that forensic bridge, 227 227
I need to have some kind of software 228 228
to do the copying for me. 229 229
I can't just use Windows copying and drag and drop files, 230 230
it doesn't work, that's not a forensically sound image. 231 231
So instead, we use imaging utilities, 232 232
and this is a software utility 233 233
that conducts the disk imaging of a given target. 234 234
Now, many image acquisition softwares are out there, 235 235
and they will also perform your cryptographic hashing 236 236
of the data being acquired. 237 237
Now, this is important 238 238
because anytime you make a copy of something, 239 239
we talked about the fact 240 240
we need to make sure we have integrity 241 241
and we know the status of it. 242 242
So if I'm making a copy of a hard drive, for instance, 243 243
I need to know what that hard drive's hash was, 244 244
and then I now have the copy 245 245
and make sure its hash matches that hard drive. 246 246
If both of those match, 247 247
that means the data is intact 248 248
in the image and the hard drive itself 249 249
and nothing's been changed. 250 250
Now, this will be done automatically for you, 251 251
if you're using something like FTK or EnCase, 252 252
but if you're using something like dd, 253 253
which we're going to talk about in a minute, 254 254
you're going to have to do that hashing function yourself. 255 255
So it is important to understand your tools 256 256
and if they have this cryptographic hashing function. 257 257
Now, when you acquire this data, 258 258
it has to be stored in a file format, 259 259
and there's different image acquisition tools 260 260
that use different acquisition formats 261 261
depending on what you're using. 262 262
For instance, if you have .eO1, that's an EnCase file, 263 263
and it's proprietary to their tool. 264 264
If you have .aff, this is the advanced forensic format, 265 265
and this is something commonly used by FTK Imager. 266 266
And then we have dd, 267 267
which is an industry standard one 268 268
that is used across the board. 269 269
It's an open source format, 270 270
and it's been around for decades. 271 271
DD is a disk duplication file, 272 272
and it is a standard image 273 273
that all tools can pretty much read. 274 274
So when you choose your tool, 275 275
you can decide what format you're going to use. 276 276
For instance, EnCase supports eO1 and dd. 277 277
FTK supports aff and dd, 278 278
and so dd works on pretty much every tool out there. 279 279
EO1 and aff work in some tools, but not all tools, 280 280
so depending on your tool, 281 281
you'll figure out what format you want to use. 282 282
Now, the reason why some people use eO1 or aff over dd 283 283
is those formats can actually store metadata as well, 284 284
like the hash and other things about your case, 285 285
and so, a lot of people like that newer format. 286 286
Speaking of dd, what is that? 287 287
Well, it's a command line tool for Unix, Linux, and macOS, 288 288
and this can perform disk image acquisition. 289 289
Basically, think about it as the disk duplicator. 290 290
That's the idea of dd. 291 291
Now, when you use dd, 292 292
you're going to provide it using a command line syntax. 293 293
You're going to have the command itself, dd, and then if=, 294 294
which is input file, and then the path to the input file. 295 295
Now, in this case, the input file is actually a hard drive. 296 296
It's /dev, for device, /sda, 297 297
which is the first hard drive on this system. 298 298
Then I have the output file, of=, 299 299
and then, where am I going to put it? 300 300
/mnt/flashdrive/evidence.dd. 301 301
And notice, I'm using the dd file format here. 302 302
Now alternatively, 303 303
if I wanted to take data from an image file 304 304
and put it onto a hard drive, 305 305
so that I can actually run it off the hard drive, 306 306
I can just swap these around, 307 307
and I can go dd input file =/mnt/flashdrive/evidence.dd, 308 308
that image file, 309 309
of=/dev/ whatever you're going to put it to, sda, for instance. 310 310
And so, that's the way dd works. 311 311
It can take anything as an input and output. 312 312
It can go file to file, device to device, 313 313
device to file, or file to device. 314 314
Now, if you're acquiring a virtual hard drive 315 315
because you're dealing with 316 316
some kind of a virtualized server or a virtual machine, 317 317
remember, those files for those servers 318 318
are already stored in a virtual image format. 319 319
If you're using Vmware, it's going to be vmdk files. 320 320
If you're using Hyper-V, it's vhd or vhdx. 321 321
If you're using VirtualBox, it's going to be vdi. 322 322
All of these are formats that could be used 323 323
depending on which tool they're using 324 324
for their virtualization solution. 325 325
So if you come across a virtualized server 326 326
that's being hosted by a hypervisor, 327 327
you can go in there and just collect that one image file 328 328
and have everything you need 329 329
for a forensically sound image right there. 330 330
Just take a hash of it before you copy it off the machine, 331 331
take a hash of it again once you acquire it, 332 332
and make sure they match, 333 333
and you have a forensically sound forensic image for it.