Scribd
Upload
2 views

Chapter 7 - Current Computer Forensics Tools

Chapter 7 of the 'Guide to Computer Forensics and Investigations' discusses various types of computer forensics tools, including hardware and software, and outlines their primary tasks such as acquisition, validation, extraction, reconstruction, and reporting. It details the subfunctions of each task, emphasizing the importance of data integrity and the challenges of data recovery, especially with encrypted files. Additionally, it highlights considerations for selecting forensics tools, including flexibility, reliability, and the need for a library of older versions.

Uploaded by

kong
Copyright
© © All Rights Reserved
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
2 views

Chapter 7 - Current Computer Forensics Tools

Chapter 7 of the 'Guide to Computer Forensics and Investigations' discusses various types of computer forensics tools, including hardware and software, and outlines their primary tasks such as acquisition, validation, extraction, reconstruction, and reporting. It details the subfunctions of each task, emphasizing the importance of data integrity and the challenges of data recovery, especially with encrypted files. Additionally, it highlights considerations for selecting forensics tools, including flexibility, reliability, and the need for a library of older versions.

Uploaded by

kong
Copyright
© © All Rights Reserved
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 18

Guide to Computer Forensics

and Investigations
Fourth Edition

Chapter 7
Current Computer Forensics
Tools
Types of Computer Forensics Tools

• Hardware forensic tools


– Range from single-purpose components to complete
computer systems and servers
• Software forensic tools
– Types
• Command-line applications
• GUI applications
– Commonly used to copy data from a suspect’s disk
drive to an image file

Guide to Computer Forensics and Investigations 2


Tasks Performed by Computer
Forensics Tools

• Five major categories:


– Acquisition
– Validation and discrimination
– Extraction
– Reconstruction
– Reporting

Guide to Computer Forensics and Investigations 3


Tasks Performed by Computer
Forensics Tools (continued)
• Acquisition
– Making a copy of the original drive
• Acquisition subfunctions:
– Physical data copy
– Logical data copy
– Data acquisition format
– Command-line acquisition
– GUI acquisition
– Remote acquisition
– Verification

Guide to Computer Forensics and Investigations 4


Tasks Performed by Computer
Forensics Tools (continued)

• Acquisition (continued)
– Two types of data-copying methods are used in
software acquisitions:
• Physical copying of the entire drive
• Logical copying of a disk partition
– The formats for disk acquisitions vary
• From raw data to vendor-specific proprietary
compressed data
– You can view the contents of a raw image file with
any hexadecimal editor

Guide to Computer Forensics and Investigations 5


Guide to Computer Forensics and Investigations 6
Tasks Performed by Computer
Forensics Tools (continued)

• Acquisition (continued)
– Creating smaller segmented files is a typical feature
in vendor acquisition tools
– All computer forensics acquisition tools have a
method for verification of the data-copying process
• That compares the original drive with the image

Guide to Computer Forensics and Investigations 7


Tasks Performed by Computer
Forensics Tools (continued)

• Validation and discrimination


– Validation
• Ensuring the integrity of data being copied
– Discrimination of data
• Involves sorting and searching through all
investigation data

Guide to Computer Forensics and Investigations 8


Tasks Performed by Computer
Forensics Tools (continued)
• Validation and discrimination (continued)
– Subfunctions
• Hashing
– CRC-32, MD5, Secure Hash Algorithms
• Filtering
– Based on hash value sets
• Analyzing file headers
– Discriminate files based on their types
– National Software Reference Library (NSRL) has
compiled a list of known file hashes
• For a variety of OSs, applications, and images

Guide to Computer Forensics and Investigations 9


Tasks Performed by Computer
Forensics Tools (continued)

• Validation and discrimination (continued)


– Many computer forensics programs include a list of
common header values
• With this information, you can see whether a file
extension is incorrect for the file type
– Most forensics tools can identify header values

Guide to Computer Forensics and Investigations 10


Tasks Performed by Computer
Forensics Tools (continued)

• Extraction
– Recovery task in a computing investigation
– Most demanding of all tasks to master
– Recovering data is the first step in analyzing an
investigation’s data

Guide to Computer Forensics and Investigations 11


Tasks Performed by Computer
Forensics Tools (continued)
• Extraction (continued)
– Subfunctions
• Data viewing
• Keyword searching
• Decompressing
• Carving
• Decrypting
• Bookmarking
– Keyword search speeds up analysis for investigators

Guide to Computer Forensics and Investigations 12


Tasks Performed by Computer
Forensics Tools (continued)

• Extraction (continued)
– From an investigation perspective, encrypted files
and systems are a problem
– Many password recovery tools have a feature for
generating potential password lists
• For a password dictionary attack
– If a password dictionary attack fails, you can run a
brute-force attack

Guide to Computer Forensics and Investigations 13


Tasks Performed by Computer
Forensics Tools (continued)

• Reconstruction
– Re-create a suspect drive to show what happened
during a crime or an incident
– Subfunctions
• Disk-to-disk copy
• Image-to-disk copy
• Partition-to-partition copy
• Image-to-partition copy

Guide to Computer Forensics and Investigations 14


Tasks Performed by Computer
Forensics Tools (continued)

• Reconstruction (continued)
– Some tools that perform an image-to-disk copy:
• SafeBack
• SnapBack
• EnCase
• FTK Imager
• ProDiscover

Guide to Computer Forensics and Investigations 15


Tasks Performed by Computer
Forensics Tools (continued)
• Reporting
– To complete a forensics disk analysis and
examination, you need to create a report
– Subfunctions
• Log reports
• Report generator
– Use this information when producing a final report for
your investigation

Guide to Computer Forensics and Investigations 16


Tool Comparisons

Guide to Computer Forensics and Investigations 17


Other Considerations for Tools

• Considerations
– Flexibility
– Reliability
– Expandability
– Keep a library with older version of your tools
• Create a software library containing older versions
of forensics utilities, OSs, and other programs

Guide to Computer Forensics and Investigations 18

You might also like