The letter t following a page number denotes a table; the letter f following a page number denotes a figure.

Numbers4Kn disks, 12, 41–44, 42f512e sector emulation, 41, 42, 43

Aabstraction layers, disk interfaces, 34, 35fAccessData. See ftkimager tool; FTK

SMART formatAce Laboratory PC-3000 tool, 122ACPO (Association of Chief Police

Officers), UK, 2, 6–7acquisition host

attaching subject disk toApple Target Disk Mode, 137–138devices with block or character

access, 140enabling access to hidden sectors,

118–125examining subject PC hardware,

101–102identifying subject drive, 105–107NVME SSDs, 138–139querying subject disk, 107–118removable storage media, 132–136viewing examiner workstation

hardware, 103–104performance, optimizing, 88–90

acquisition process. See forensic acquisition

ACS (ATA Command Set). See ATA commands

Advanced Forensic Format. See AFFAdvanced Format 4Kn disks, 12,

41–44, 42fAdvanced Format 512e disks, 41, 42, 43Advanced Host Controller Interface

(AHCI) mode, SATA, 23–24Advanced Technology Attachment

commands. See ATA commands

AFF (Advanced Forensic Format)aff4imager tool, 190affcat tool, 209–210affconvert tool, 204–205, 209affcrypto tool, 215affinfo tool, 198, 210, 211AFFlib software package

affuse tool, 196–197, 235built-in compression, 190built-in encryption, 215overview, 62piping, 209signing and validating

signatures, 202built-in compression, 190built-in encryption, 215converting raw images to, 204–205converting to another format,

209–211overview, 62–63piping, 209recalculating hash of forensic image,

198–199AHCI (Advanced Host Controller

Interface), mode, SATA, 23–24

aimage tool, 190Appelbaum, Jacob, 251Apple

FileVault, 248–251Target Disk Mode, 31, 137–138Thunderbolt interface, 30–32, 31f, 137

array-info tool, 178Association of Chief Police Officers

(ACPO), UK, 2, 6–7ATA (Advanced Technology Attachment)

commandscommon, 35tDCO and HPA drive areas, 39–40overview, 34–36password-protected disks, 126–128and SCSI, 39security erase command, 226–227SSD devices, 16–17

ATA Command Set (ACS). See ATA commands

I n d e x

278 Index

ATAPI (ATA Packet Interface)DCO and HPA drive areas, 39–40overview, 35–36password-protected disks, 126–128SCSI commands, 39

Atola Insight Forensic, 122auditd package, 76audit trail

overview, 70shell history, 73–75task management, 70–73terminal monitors and Linux

auditing, 76terminal recorders, 75–76

aureport command, 76

BBash (Bourne Again shell), 56, 73, 74, 82.

See also command lineBash math expansion, 183, 248, 249, 252,

265, 274bdeinfo command, 248bdemount command, 248BDs. See Blu-ray discs; optical storage

mediaBeginning of Media (BOM) marker,

on tapes, 176Beginning of Tape (BOT) marker,

on tapes, 176BitLocker, Microsoft, 243–248blkcat command, 274blkls command, 271–272blktap-utils tool, 241blockdev command, 43, 98, 99, 108block devices

acquiring, 172–173attaching to acquisition host, 140creating from raw image, 230Linux, 50–55making QCOW2 image available as,

237–239block-level encryption systems. See

encrypted filesystems, accessing

Blu-ray discs (BDs), 19f, 21–22. See also optical storage media

acquiring, 174, 175transferring forensic image to,

222, 223BOM (Beginning of Media) marker,

on tapes, 176bootable Linux CDs, 98, 99

boot images, preparing with xmount, 235–237

BOT (Beginning of Tape) marker, on tapes, 176

BOT (Bulk-Only Transport) USB interface, 29, 40–41

bottlenecks, performance, 88–90, 91tBourne Again shell (Bash), 56, 73, 74, 82.

See also command lineBulk-Only Transport (BOT) USB

interface, 29, 40–41burning forensic image to optical disc,

221–222bus speeds, 90, 91t. See also interfacesbzip tool, 188, 189

CCA (certificate authority) certificates,

156, 157, 201–202C.A.I.N.E. boot CD, 99card readers, 18Carrier, Brian, 48carving tools, 165cat command, 196, 199cciss-vol-status package, 178CDB (command descriptor block), 36cd-drive command, 132–133cd-info command, 133cdparanoia tool, 175CDs (compact discs). See also optical

storage mediaacquiring, 174, 175Linux forensic boot, 98, 99as storage media, 19f, 20–21transferring forensic image to,

221–222certificate authority (CA) certificates,

156, 157, 201–202CF (CompactFlash) card, 18CFTT (Computer Forensic Tool Testing)

projectdd utility tests, 60forensic-imaging requirements, 9HWB Device Specification, 94overview, 3, 6software write blockers, 99

chip-off, 15, 125Choudary, Omar, 248CipherShed, 217client mode, rdd tool, 166, 167–168cloned disks, 219–221Coltel, Romain, 243command descriptor block (CDB), 36

Index 279

command line. See also Linux; specific commands/tools

audit trail, 70–76command privileges, xxv, 212, 233organizing output, 76–83output

organizing, 76–83redirecting, 81–83scalable examination directory

structure, 79–81reasons to use, xx–xxisaving output with redirection, 81–83shell history, 73–75task management, 70–73terminal monitors and Linux

auditing, 76terminal recorders, 75–76viewing examiner workstation

hardware, 103–104command sets

ATA, 34–36, 35tNVME, 37–38, 37tSCSI, 36–37, 37t, 39

compact discs. See CDs; optical storage media

CompactFlash (CF) card, 18completeness, forensic, 10completion times, estimating, 87–88compression

AFFlib built-in, 190combining with splitting, 192EnCase EWF compressed format, 189FTK SMART compressed format, 190SquashFS, 66–67, 191

Computer Forensic Tool Testing project. See CFTT project

computer-related forensics. See digital forensics; forensic acquisition

converting between image formats, 202–211

conv=noerror parameter, dd utility, 143copying forensic images, 87Copy-on-Write (CoW) snapshots, live

imaging with, 172Coroner’s Toolkit, The, 2Corsair Padlock2 thumb drive, 228CoW (Copy-on-Write) snapshots, live

imaging with, 172cpqarrayd tool, 178cryptography. See also encrypted

filesystems, accessing; encryption

basic hashing, 151–152, 151thash windows, 143, 152–154, 199–200

key-wiping procedures, 227–228RFC-3161 timestamping, 157–159signing forensic images, 154–157verifying forensic image integrity,

197–202cryptsetup tool, 251–254, 257ctrl-Z shortcut, 92–93, 123curl command, 158

Ddares carver tool, 165data CDs, 20. See also CDs; optical storage

mediadata disposal, 224–228data extraction

manual, using offsets, 272–274partition extraction, 264–271partition scheme analysis, 259–264slack space, 271–272unallocated blocks, 272

data flow, optimizing, 90data recovery tools, 61–62, 162–163dc3dd tool

acquiring image to multiple destinations, 150

cryptographic hashing algorithms, 151–152, 151t

error handling, 160–161forensic acquisition with, 142, 144–145optical discs, imaging, 174–175overview, 61piecewise hashing, 153–154splitting functionality, 193SquashFS forensic evidence

containers, 65, 149wiping functionality, 225–226writing image file to clone disk,

220–221dcfldd tool

acquiring image to multiple destinations, 150

compressing images, 189cryptographic hashing algorithms,

151, 151tencryption during acquisition, 212error handling, 160forensic acquisition with, 142,

144–145hash windows, 153overview, 61partition extraction, 266splitting functionality, 192–193tapes, extracting data from, 177

280 Index

DCO (Device Configuration Overlay)extracting sector ranges belonging

to, 269–271overview, 39–40, 118removing, 118–121

dd_rescue tool, 61, 62, 142, 163, 215–216ddrescue tool, 61, 142, 162–163, 165dd utility

combining compressing and splitting, 192

cryptographic hashing algorithms, 152

forensic acquisition with, 142–144forensic variants, 61, 144–145manual extraction using offsets,

273–274partition extraction, 266raw images, 60secure remote imaging, 168, 169–170sparse files, 85validating acquisition hash, 197–198wiping functionality, 226

debug ports, accessing storage media using, 122–125

decryption. See also cryptography; encrypted filesystems, accessing; encryption

of GPG-encrypted image, 212, 213of OpenSSL-encrypted file, 213–214

DEFT (Digital Evidence & Forensics Toolkit), 98–99

deleted partitions, extracting, 266–268deleting forensic image data, 224–228desktop environments, Linux, 56/dev directory, Linux, 50, 51–52Device Configuration Overlay. See DCOdevice mapper, 179–182, 231–232, 253,

255–256device tree, Linux, 50–51DFRWS (Digital Forensic Research

Workshop), 2, 8, 59diagnostic ports, accessing storage media

using, 122–125Diaz Diaz, Antonio, 61, 162diff tool, 200Digital Evidence & Forensics Toolkit

(DEFT), 98–99digital evidence bags. See forensic file

formatsDigital Forensic Research Workshop

(DFRWS), 2, 8, 59

digital forensics. See also forensic acquisition

defined, 2history of, 1–4Linux and OSS in context of, 48–50peer-reviewed research, 7–8principles of, 6–10standards for, 6–7trends and challenges, 4–5

Digital Investigation: The International Journal of Digital Forensics & Incident Response, 7

digital signatures, 154–157digital versatile discs. See DVDs; optical

storage mediadirectories

naming conventions for, 76–79scalable examination structure, 79–81

disk block recovery tools, 162–163disk cloning and duplication, 219–221disk coolers, 93disk imaging. See forensic acquisitiondisk partition scheme, analyzing, 259–264disks. See forensic acquisition; storage

media; subject diskdisktype tool, 260–261, 263dislocker package, 243–247dismounting VeraCrypt volume, 218. See

also unmountingdisposal, data, 224–228distributions, Linux, 55–56dm-crypt encryption, 251, 254dmesg tool, 206dmraid tool, 178–179dmsetup tool, 159–160, 179–180, 182, 183documenting device identification

details, 107–108DOS partition scheme, 262dpt-i2o-raidutils package, 178drive maintenance sectors, 40, 122–125drives. See forensic acquisition; specific

media; storage media; subject disk

Dulaunoy, Alexandre, 61duplication, disk, 219–221DVDs (digital versatile discs), 19f, 21. See

also optical storage mediaacquiring, 174, 175overview, 21reassembling split forensic images, 196transferring forensic image to, 222

dynamic disks, Microsoft, 181–182

Index 281

EEIDE (Enhanced Integrated Drive

Electronics), 32eject shell command, 133Electronic Crime Scene Investigation: A

Guide for First Responders (US DOJ), 3, 7

EnCase EWFbuilt-in encryption, 215compressed format, 189converting AFF images to, 209–210converting FTK files to, 208converting raw images to, 202–203converting to another format,

205–208forensic acquisition, 145–146hash windows, 153image access tasks, 233–234overview, 62recalculating hash of forensic

image, 198remote forensic acquisition, 171–172splitting images during

acquisition, 193encrypted filesystems, accessing

Apple FileVault, 248–251Linux LUKS, 251–254Microsoft BitLocker, 243–248overview, 243TrueCrypt, 254–257VeraCrypt, 254–257

EncryptedRoot.plist.wipekey file, 249–250encryption. See also cryptography;

encrypted filesystems, accessing

flash drives, 17, 131, 131f, 228key-wiping procedures, 227–228Opal, 128–131securing disk image with, 211–218

Enhanced Integrated Drive Electronics (EIDE), 32

environmental factors, 91–93EO1. See EnCase EWFEOD (End of Data) marker, on tapes,

14, 176EOF (End of File) marker, on tapes, 176EOM (End of Media) marker, on

tapes, 176EOT (End of Tape) marker, on tapes, 176erasing forensic image data, 224–228errors, drive, 159–165estimated completion time, 87–88

evidencecontainers. See forensic file formatsdisk. See subject disk integrity of, 197–202. See also

cryptographyorganizing, 76–83

EWF. See EnCase EWFewfacquirestream tool, 172, 210ewfacquire tool

compressing images, 189converting raw images to EWF,

202–203cryptographic hashing algorithms,

151, 151terror handling, 161forensic acquisition, 141, 145–147splitting images during

acquisition, 193ewfexport tool, 205, 206, 207ewfinfo tool, 206, 207ewfmount tool, 233, 234ewfverify tool, 198examination directory structure, 79–81examination host. See acquisition hostExpert Witness Format. See EnCase EWFEXTENDED SECURITY ERASE command, 227Extensible Host Controller Interface

(xHCI), 29–30external drives, encrypting, 216, 217–218extracted files, naming conventions for,

77–78extracting subsets of data. See data

extraction

Ffailure, drive, 159–165FC (Fibre Channel) interface, 25–26, 26fFDE (full-disk encryption), 128–131,

216–218fg command, 93Fibre Channel (FC) interface, 25–26, 26ffile compression, 85file formats. See forensic file formatsfiles, naming conventions for, 76–79file shredder, 224–225file sizes, reporting, 86–87file slack, 43filesystems. See also encrypted filesystems,

accessingaccessing forensic file format as,

233–235data CD, 20

282 Index

filesystems, continuedgeneral purpose disk encryption,

216–217, 218identifying, 263–264Linux kernel and, 52–55slack space, extracting, 271–272unallocated blocks, extracting, 272

file transfer protocols, 224FileVault, Apple, 248–251FileVault Cracking software, 251FireWire (IEEE1394) interface, 33,

33f, 137first responder triage of live PCs, 102flash drives, 17, 131, 131f, 173, 228flash memory. See non-volatile memoryFlash Translation Layer (FTL), 15fls command, 180, 238, 242, 249–250,

265–266forensic acquisition. See also data

extraction; digital forensics; forensic image management; image access tasks

completeness of, 10dd-based tools, 142–145encryption during, 212, 213, 214with forensic formats, 145–150Linux as platform for, 47–57managing drive failure and errors,

159–165to multiple destinations, 150over network, 166–172overview, 141, 275–276peer-reviewed research, 7–8performance, 88–90, 91tprerequisites, 9RAID and multidisk systems, 178–184removable media, 172–178signing forensic images, 154–157splitting image during, 192–194standards for, 6–7suspending process, 92–93tools for, choosing between, 141–142trends and challenges, 4–5verifying hash during, 197–198writing image file to clone disk,

220–221forensic boot CDs, 98, 99forensic file formats. See also specific

formatsacquiring image with, 145–150built-in encryption, 214–216converting between, 202–211

image access tasks, 233–235image compression support, 188naming conventions for, 77overview, , 59–60raw images, 60–62SquashFS, 63–67

forensic filesystem analysis, 271, 274forensic image management

compression, 187–191converting between image formats,

202–211disk cloning and duplication,

219–221overview, 187secure wiping and data disposal,

224–228securing image with encryption,

211–218split images, 191–197transfer and storage, 221–224verifying image integrity, 197–202

forensic imaging. See forensic acquisitionforensic readiness, 69–70forensic write blockers. See write blockersforks, in open source software, 49formats, file. See forensic file formatsFreeTSA, 158, 159, 201freeze commands, ATA password-

protected disks, 127frozen DCO configuration, 119–120fsstat command, 263–264ftkimager tool

built-in encryption, 214–215compressing images, 190converting files from EnCase to FTK,

207–208converting from FTK format, 208–209converting raw image to FTK

SMART, 203cryptographic hashing algorithms,

151, 151terror handling, 161–162forensic acquisition, 141, 147–149overview, 62splitting images during acquisition,

193–194FTK SMART format

compressed format, 190converting AFF images to, 209–210converting EnCase EWF files to,

207–208converting raw images to, 203

Index 283

converting to another format, 208–209

overview, 62remote forensic acquisition, 171–172

FTL (Flash Translation Layer), 15full-disk encryption (FDE), 128–131,

216–218FUSE filesystem, 196, 233, 241–243, 245,

246, 250–251fusermount command, 234fvdeinfo tool, 249fvdemount tool, 250–251

GGarfinkel, Simson, 62Garloff, Kurt, 62, 163Globally Unique Identifier (GUID), LDM

disk group, 181GNU dd. See dd utilityGNU dd_rescue tool, 61, 62, 142, 163

215–216GNU ddrescue tool, 61, 142, 162–163, 165GNU Privacy Guard (GnuPG or GPG),

155–156, 200–201, 211–213GNU screen terminal multiplexer, 75–76GNU split command, 192gpart tool, 267GPG (GNU Privacy Guard), 155–156,

200–201, 211–213gpgsm tool, 156–157gptparser.pl tool, 263GPT partition scheme, 262Grenier, Christophe, 267growisofs command, 222GUID (Globally Unique Identifier), LDM

disk group, 181Guidance Software. See EnCase EWFGUI interface

versus command line, xxiLinux, 55–56

gunzip tool, 188, 213gzip tool, 188–189, 192, 204, 214

HHarbour, Nicholas, 61hard disks. See also forensic acquisition;

storage media; subject diskmagnetic, 12–13, 13fservice areas, 40transferring forensic image to, 223

hardwareexaminer workstation, viewing,

103–104managing drive failure and errors,

159–165subject PC, examining, 101–102write blockers, 39, 94–97, 94f, 95f, 97f,

107–108Hardware Write Block (HWB)

Device Specification, Version 2.0, 94

hashingbasic, 151–152, 151tGPG encryption, 213OpenSSL encryption, 214overview, 197recalculating hash, 198–199split raw images, 199verifying hash during acquisition,

197–198hash windows, 143, 152–154, 199–200HBA (host bus adapter), 36hd (hexdump) tool, 226HDDGURU, 125HDD Oracle, 125hddtemp tool, 91hdparm tool

ATA password-protected disks, 126, 127

ATA security erase unit commands, 227

DCO, removing, 118–120HPA

removing, 121–122replicating sector size with, 220sector ranges, extracting, 270

querying disk capabilities and features with, 108–112

read-only property, 98SSDs, 16–17

heat, monitoring, 91–93heat sinks, 93hexdump (hd) tool, 226hidden sectors, enabling access to

DCO removal, 118–121HPA removal, 121–122overview, 118system areas, 122–125

hidden volume, VeraCrypt, 256–257history, shell, 73–75host bus adapter (HBA), 36

284 Index

HPA (Host Protected Area)extracting sector ranges belonging

to, 269–271overview, 39–40, 118removing, 121–122replicating sector size with, 219–220

Hulton, David, 251HWB (Hardware Write Block) Device

Specification, Version 2.0, 94hxxp, 79

IIAAC (Information Assurance Advisory

Council), 8icat tool, 249–250IDE (Integrated Drive Electronics), 18,

32, 32fIEEE1394 (FireWire) interface, 33,

33f, 137image access tasks. See also encrypted

filesystems, accessingboot images, preparing with xmount,

235–237forensic format image files, 233–235overview, 229–230raw images, 230–233VM images, 237–243

image acquisition/imaging. See forensic acquisition

img_stat command, 59–60, 194, 195, 197–198

industrycollaboration within, 5regulations and best practice, 8–9

Information Assurance Advisory Council (IAAC), 8

information security, 211–218initiator, SCSI commands, 36Integrated Drive Electronics (IDE), 18,

32, 32fintegrity. See cryptography; verifying

forensic image integrityinterfaces. See also specific interfaces

bus speeds, 90, 91tlegacy, 32–34, 32f, 33f, 34fNVME, 27–29, 27f, 28foverview, 22SAS and Fibre Channel, 25–26,

25f, 26fSATA, 22–25, 23f, 24f, 25fThunderbolt, 30–32, 31fUSB, 29–30, 29f, 30f

International Organization for Standardization (ISO), 6

International Organization of Computer Evidence (IOCE), 2, 3

Internet of Things, 4inter-partition gaps, extracting, 269IOCE (International Organization of

Computer Evidence), 2, 3ISO (International Organization for

Standardization), 6iStorage datashur drives, 228

Jjail-broken devices, 5JBOD (Just a Bunch Of Disks), 179–180JTAG interface, 125jumper setting, Advanced Format 512e

disks, 43Just a Bunch Of Disks (JBOD), 179–180

KKali Linux, 99kernel, Linux

defined, 55determining partition details, 264and filesystems, 52–55and storage devices, 50–52

kernel patch, write-blocking, 98–99kernel ring buffer, 106Kessler, Gary, 262–263key-wiping procedures, 227–228Kornblum, Jesse, 61kpartx tool, 231, 233, 234, 241, 242

Llaw enforcement, and digital forensics

collaboration, 5history of, 1–2

LDM (Logical Disk Manager), 181ldmtool tool, 181legacy technologies

magnetic, 15optical storage media, 22storage media interfaces, 32–34, 32f,

33f, 34fLenovo ThinkPad Secure Hard Drives,

216, 216flibata library, 39libbde package, 247–248libewf library, 62, 215libfvde software package, 248–251libqcow-utils package, 237libvhdi tools, 241libvmdk-utils software package, 240

Index 285

link layer, disk interfaces, 34, 35f, 38Linux. See also command line; specific

commandsAdvanced Format 4Kn disks, 42–43Apple Target Disk Mode, 137–138audit trail, 76command execution, 56compression tools, 188–189distributions, 55–56forensic boot CDs, 98, 99in forensic context, 48–50kernel and filesystems, 52–55kernel and storage devices, 50–52loop devices, 230–233LUKS, 251–254overview, xx–xxi, 47, 57piping and redirection, 56–57RAID-5 acquisition, 183–184SCSI commands, 36–37shell history, 73, 74shells, 56software RAID, 178Thunderbolt interface, 31–32

Linux Storage Stack Diagram, 52, 53flive imaging with CoW snapshots, 172live PCs, triage of, 102locked DCO configuration, 119–120Logical Disk Manager (LDM), 181Logical Volume Manager (LVM)

layers, 254logistical issues

environmental factors, 91–93estimating task completion times,

87–88file compression, 85image sizes and disk space

requirements, 83–84moving and copying forensic

images, 87overview, 83performance and bottlenecks,

88–90, 91treported file and image sizes, 86–87sparse files, 85–86

logs, SMART, 115long-term storage of forensic images,

221–224loop devices, 183–184, 230–233, 252–253,

265–266loop option, mount command, 245, 247losetup command, 183, 230, 231, 252, 265Lougher, Phillip, 63lsblk command, 106–107, 108ls command, 86–87, 196

lshw tool, 103, 104, 133–134lspci tool, 103–104lsscsi command, 105, 108lsusb tool, 104, 105, 108luksDump command, 252–253LUKS encryption system, 251–254LVM (Logical Volume Manager)

layers, 254

MM.2 interface

NVME, 27, 27fSATA, 24, 24f

magnetic storage media. See also hard disks; magnetic tapes

legacy, 15overview, 12

magnetic tapes, 14facquiring, 176–178attaching to acquisition host, 133–135overview, 13–14with physical read-only modes, 100

maintenance sectors, 40, 122–125managing image files. See forensic image

managementmanual extraction using offsets, 272–274mapper devices, 179–182, 231–232, 253,

255–256mass storage technologies. See storage

mediamaster boot record (MBR), 129master password, ATA password-

protected disks, 126–127, 128maximum visible sectors, on clone

drive, 220MBR (master boot record), 129md5sum tool, 152, 154, 207mdadm tool, 183, 184media. See storage mediamemory. See specific types of memory;

storage mediamemory cards, 18f

acquiring, 173–174attaching to acquisition host, 136overview, 17–18

memory slack, 43metadata, forensic file formats, 62Metz, Joachim, 62, 237, 247, 248micro IDE ZIF interface, 33, 33fmicro SATA interface, 24, 24fMicro SD cards, 173–174Microsoft BitLocker, 243–248Microsoft dynamic disks, 181–182

286 Index

Microsoft VHD format, 241–243mini IDE interface, 33, 33fMini-SAS HD interface, 26fmini-SATA (mSATA) interface, 23, 23fmirrored disks, RAID-1, 182–183mismatched hash windows, 199–200mkisofs command, 221–222mksquashfs tool, 63, 170, 206–207mmcat tool, 266, 268, 269, 270mmls command, 262mmstat command, 260, 261mount command, 184, 241, 245, 247mounting

decrypted filesystem image, 245, 246, 247, 250, 253, 256

filesystems in Linux, 53–54forensic format image files, 233–235image files as regular filesystems, 229loop partitions, 232–233SquashFS container, 66VeraCrypt volume, 218VM images, 236, 238–239, 240–243

moving forensic images, 87mpt-status tool, 178mSATA (mini-SATA) interface, 23, 23fmsed tool, 129mt tool, 134–135multidisk systems, acquiring

JBOD and RAID-0 striped disks, 179–180

Linux RAID-5, 183–184Microsoft dynamic disks, 181–182overview, 178proprietary systems, 178–179RAID-0 striped disks, 179–180RAID-1 mirrored disks, 182–183

multifunction drivebay write blocker, 94, 95f

multiple destinations, forensic acquisition to, 150

music CDs, 20, 175. See also CDs; optical storage media

myrescue tool, 163

Nnamespaces, NVME, 44–45, 138, 139, 226naming conventions for files and

directories, 76–79NAND flash technology, 15National Institute of Standards and

Technology. See CFTT projectnbd kernel module, 237–238, 239negative sectors, 40, 122–125

Netherlands Forensic Institute (NFI), 166network

image acquisition overto EnCase or FTK format,

171–172live imaging with CoW

snapshots, 172overview, 166with rdd, 166–168to SquashFS evidence container,

169–171with ssh, 168–169transferring acquired images,

223–224, 223tperformance tuning, 90

Next Generation Form Factor (NGFF), 27NFI (Netherlands Forensic Institute), 166NIST. See CFTT projectnonprivileged user, 241–243, 246, 251, 254non-volatile memory

legacy, 19overview, 15–16removable memory cards, 17–18, 18fsolid state drives, 16–17, 16fUSB flash drives, 17, 17f

Non-Volatile Memory Express (NVME) command set, 37–38, 37tinterface, 27–29, 27f, 28fnamespaces, 44–45, 138, 139, 226nvme-cli software package, 44–45nvme tool, 138, 139SSDs, 138–139wiping drives, 226

nwipe tool, 226

Oof= flags, dc3dd tool, 150--offset flag, losetup command, 231offsets, manual extraction using, 272–274Opal self-encrypting drives, 128–131, 228opengates tool, 236openjobs tool, 236open source software (OSS), 48–50, 276OpenSSH software package, 224OpenSSL command line tool, 157–159,

201–202, 213–214optical storage media

acquiring, 174–175attaching to acquisition host, 132–133Blu-ray discs, 19f, 21–22

acquiring, 174, 175transferring forensic image to,

222, 223

Index 287

CDs, 19f, 20–21acquiring, 174, 175Linux forensic boot, 98, 99transferring forensic image to,

221–222damaged, 165DVDs, 19f, 21

acquiring, 174, 175reassembling split forensic

images, 196transferring forensic

image to, 222legacy, 22overview, 19–20transferring forensic image to,

221–223OS-encrypted filesystems. See encrypted

filesystems, accessingOS image, booting in VM, 235–237OSS (open source software), 48–50, 276OS X, booting image in VM, 236over-provisioning, 15–16

PParallel ATA (PATA), 18parallel interfaces, 22parsing tools, 262–263partition devices, 51–52, 231–233, 238,

239–240partition extraction

deleted, 266–268HPA and DCO sector ranges,

269–271individual, 264–266inter-partition gaps, 269overview, 264

partition scheme, analyzing, 259–264partition tables, 261–263password-protected disks, 126–128password recovery techniques, 125PATA (Parallel ATA), 18PC-3000 tool, Ace Laboratory, 122PCI bus, listing devices attached to,

103–104PCI Express write blockers, 96, 97fPEM signature file, 157, 201Pentoo forensic CD, 99PEOT (Physical End of Tape) marker, 176performance, forensic acquisition,

88–90, 91tPGP (Pretty Good Privacy), 155–156PHY devices, 38Physical End of Tape (PEOT) marker, 176

physical errors, SMART data on, 117–118physical layer, disk interfaces, 34, 35f,

38–39physical PC examination, 102physical read-only modes, media with,

100, 100fPhysical Security ID (PSID), 128,

129f, 228piecewise data extraction. See data

extractionpiecewise hashing, 152–154, 199–200piping

acquiring image to multiple destinations, 150

with AFF files, 209combining compressing and

splitting, 192compressing images with, 189cryptographic hashes of split raw

images, 199cryptographic hashing

algorithms, 152in Linux, 56–57to validate acquisition hash, 197–198

PKI (public key infrastructure), 156, 216plain dm-crypt encryption, 251, 254planning for forensic acquisition. See

preparatory forensic taskspost-acquisition tasks. See data extraction;

forensic image management; image access tasks

postmortem computer forensics. See digital forensics; forensic acquisition

power management, 93preparatory forensic tasks. See also

logistical issuesaudit trail, 70–76organizing collected evidence and

command output, 76–83overview, 69–70write-blocking protection, 93–100

Pretty Good Privacy (PGP), 155–156private sector forensic readiness, 70privileges, command, xxv, 212, 233. See

also nonprivileged userproc filesystem, Linux, 107proprietary RAID acquisition, 178–179pseudo definition file, mksquashfs, 206PSID (Physical Security ID), 128,

129f, 228public key infrastructure (PKI), 156, 216public sector forensic readiness, 70

288 Index

QQCOW2 format, 237–239qcowinfo tool, 237qcowmount tool, 237QEMU emulator, 237–239qemu-img command, 237qemu-nbd tool, 237–238, 239querying subject disk

documenting device identification details, 107–108

extracting SMART data, 112–118with hdparm, 108–112overview, 107

RRAID (Redundant Array of Independent

Disks) systems, acquiringJBOD striped disks, 179–180Linux RAID-5, 183–184Microsoft dynamic disks, 181–182overview, 178proprietary systems, 178–179RAID-0 striped disks, 180RAID-1 mirrored disks, 182–183

RAM slack, 43raw devices, in Linux, 51, 52raw images

accessing forensic file format as, 233–235

converting to and from AFF, 209converting to another format,

202–205cryptographic hashes of split, 199data recovery tools, 61–62dd utility, 60forensic dd variants, 61image access tasks, 230–233naming conventions for, 77overview, 60preparing boot images with

xmount tool, 236reassembled, 196–197writing to clone disk, 220–221

rdd tool, 166–168read errors, dd utility, 143–144read-only modes, media with, 100, 100fread-only property, setting with write

blockers, 97–98reassembling split forensic images,

195–197

recalculating hash of forensic image, 198–199

Recorder Identification Code (RID), CDs, 21

recoverdm tool, 163redirection

with AFF files, 209compressing images with, 189in Linux, 56–57saving command output with, 81–83

Redundant Array of Independent Disks. See RAID systems, acquiring

regulations, industry-specific, 8–9remapped sectors, 40remote access to command line, xxiremote forensic acquisition

to EnCase or FTK format, 171–172live imaging with CoW snapshots, 172overview, 166with rdd, 166–168secure, with ssh, 168–169to SquashFS evidence container,

169–171transferring acquired images,

223–224, 223tremovable storage media. See also specific

media types; storage mediaacquiring, 172–178attaching to acquisition host, 132–136encrypting, 216transferring forensic image to,

221–223reported file and image sizes, 86–87research, peer-reviewed, 3, 7–8RFC-3161 timestamping, 157–159, 201RID (Recorder Identification

Code), CDs, 21ring buffer, kernel, 106ripping music CDs, 175

SS01. See FTK SMART formatSAS (Serial Attached SCSI) interface,

25–26, 25f, 26f, 37SAT (SCSI-ATA Translation), 39SATA (Serial ATA) interface, 16, 22–25,

23f, 24f, 25f, 94fSATA Express disk interface, 25, 25fscalable examination directory structure,

79–81

Index 289

Scientific Working Group on Digital Evidence (SWGDE), 3

scp (secure copy) tool, 224screen terminal multiplexer, 75–76script command, 75scripting, with command line, xxiscriptreplay command, 75SCSI-ATA Translation (SAT), 39SCSI interface, 34f

command sets for, 36–37, 37t, 39documenting device identification

details, 108identifying subject drive, 105overview, 33–34querying drives, 112tape drives, querying, 134

SD (Secure Digital) standard, 18sdparm command, 112sector offsets

converting into byte offset, 247–248, 249, 252, 265

filesystem identification, 263–264manual extraction using, 272–274

sectors. See also hidden sectors, enabling access to; 4Kn disks

hard disks, 12, 40replicating with HPA, 219–220user-accessible, wiping, 225–226

secure copy (scp) tool, 224secure_deletion toolkit, 224Secure Digital (SD) standard, 18Secure/Multipurpose Internet Mail

Extensions (S/MIME), 155, 156–157, 201

secure network data transfer, 223–224secure remote imaging, 168–169secure wiping and data disposal, 224–228security erase command, ATA, 226–227security features, subject disk

ATA password-protected disks, 126–128

encrypted flash thumb drives, 131overview, 125self-encrypting drives, 128–131

security levels, ATA password-protected disks, 127

security of forensic image, 211–218SEDs (self-encrypting drives), 128–131,

218, 228sedutil-cli command, 129–130, 218, 228seeking, within compressed files, 188, 204

self-encrypting drives (SEDs), 128–131, 218, 228

Self-Monitoring, Analysis and Reporting Technology (SMART)

extracting data with smartctl, 112–118managing drive failure and errors,

163–164NVME drives, 139

self-tests, SMART data on, 115–116serial access to disks, 122–125Serial ATA (SATA) interface, 16, 22–25,

23f, 24f, 25f, 94fSerial Attached SCSI (SAS) interface,

25–26, 25f, 26f, 37serial bus controller class, 104serial point-to-point connections, 22server mode, rdd tool, 166, 167, 168service areas, 40, 122–125sessions, CD, 20sfsimage tool

acquiring image with, 149–150converting AFF file to compressed

SquashFS, 210converting FTK files to SquashFS,

208–209converting raw image to SquashFS,

203–204dcfldd and dc3dd tools, 145image access tasks, 235overview, 63remote forensic acquisition, 169–171removable media, acquiring

image of, 174SquashFS compression, 191SquashFS evidence containers, 64–67

sg3_utils software package, 36–37shadow MBR on Opal SEDs, 129–130, 131shared buses, 22shell alias, 72–73shell history, 73–75shells. See Bash; command lineshredding files, 224–225SID (Source Unique Identifier), CDs, 21sigfind tool, 266signatures, confirming validity of,

200–202signing forensic images, 154–157size

disk image, 83–84reported file and image, 86–87

skip parameter, for partition extraction with dd, 266

290 Index

slack space, 43, 271–272Sleuth Kit

blkcat command, 274blkls command, 271–272fls command, 180, 238, 242, 249–250,

265–266fsstat command, 263–264img_stat command, 59–60, 194, 195,

197–198mmcat tool, 266, 268, 269, 270mmls command, 262mmstat command, 260, 261sigfind tool, 266

SMART (FTK forensic format).See FTK SMART format

SMART (Self-Monitoring, Analysis and Reporting Technology)

extracting data with smartctl, 112–118managing drive failure and errors,

163–164NVME drives, 139

smartctl command, 91–92, 112–118S/MIME (Secure/Multipurpose Internet

Mail Extensions), 155, 156–157, 201

Snoopy command logger, 74–75software

open source, 48–50proprietary, 49–50write blockers, 97–99, 108

solid state drives (SSDs), 12, 16–17, 16f, 43, 138–139

Solid State Hybrid Disks (SSHDs), 45source-level access, to open source

software, 48Source Unique Identifier (SID), CDs, 21space requirements, 83–84sparse files, 85–86split command, 192split forensic images

accessing, 194–195cryptographic hashes of, 199during acquisition, 192–194overview, 191–192reassembling, 195–197

SquashFSbackground of, 63burning file to CD, 221–222converting AFF file to compressed,

210–211converting FTK files to, 208–209converting raw images, 202–205

forensic evidence containers, 64–67, 149–150, 191

image access tasks, 235manual container creation, 205–207overview, 63remote forensic acquisition, 169–171

squashfs-tools package, 64SSDs (solid state drives), 12, 16–17, 16f,

43, 138–139ssh command, 168–172SSHDs (Solid State Hybrid Disks), 45standards, digital forensics, 6–7stderr, 82stdin, 82, 189stdout, 81–82, 189storage, forensic image, 221–224storage media. See also forensic

acquisition; specific media types; subject disk

Advanced Format 4Kn disks, 12, 41–44, 42f

DCO and HPA drive areas, 39–40encrypting, 216–218examiner workstation hardware,

103–104image sizes and disk space

requirements, 83–84interfaces and connectors, 22–32Linux kernel and, 50–52, 53fmagnetic, 12–15naming conventions for, 77, 78non-volatile memory, 15–19NVME namespaces, 44–45optical, 19–22overview, 11–12, 46remapped sectors, 40scalable examination directory

structure, 80, 81secure disk wiping, 225–226Solid State Hybrid Disks, 45system areas, 40, 122–125terms used for, xxvitrends and challenges, 4UASP, 29, 40–41write-blocking protection, 93–100

strace command, 195striped disks, 179–180subject disk. See also forensic acquisition;

storage mediaattaching to acquisition host

Apple Target Disk Mode, 137–138devices with block or character

access, 140

Index 291

enabling access to hidden sectors, 118–125

examining subject PC hardware, 101–102

identifying subject drive, 105–107NVME SSDs, 138–139overview, 101querying subject disk, 107–118removable storage media,

132–136security features, 125–131viewing examiner workstation

hardware, 103–104defined, xxviimage sizes and disk space

requirements, 83–84preparing boot images with xmount

tool, 235–237removal from PC, 102temperature monitoring, 91–93

subsets of data, extracting. See data extraction

sudo command, 212, 242–243, 246, 251, 254

support, for open source software, 48, 49suspect disk. See subject disksuspending acquisition process, 92–93SWGDE (Scientific Working Group on

Digital Evidence), 3symmetric encryption, 211–213, 215–216sync parameter, dd utility, 143/sys pseudo filesystem, 42–43system areas, 40, 122–125

Ttableau-parm tool, 95–96, 121Tableau write blocker, 94f, 95–96tapeinfo tool, 134–135tapes, magnetic, 14f

acquiring, 176–178attaching to acquisition host, 133–135overview, 13–14with physical read-only modes, 100

target, SCSI commands, 36Target Disk Mode (TDM), Apple, 31,

137–138task completion times, estimating, 87–88task management, 70–73Taskwarrior, 71–72TCG (Trusted Computing Group), 128tc-play, 217TDM (Target Disk Mode), Apple, 31,

137–138

tee command, 152temperature data, SMART, 116–117temperature monitoring, 91–93terminal monitors, 76terminal multiplexers, 75–76terminal recorders, 75–76testdisk tool, 267–268text files, naming conventions for, 78, 79thumb drives, 17, 131, 131f, 173, 228Thunderbolt interface, 30–32, 31f, 137Thunderbolt-to-FireWire adapter,

137–138time command, 82timestamps, 82–83, 157–159, 201–202tmux terminal multiplexer, 75–76todo.txt file format, 72transfer, forensic image, 221–224transport layer, disk interfaces, 34, 35fTrapani, Gina, 72triage of live PCs, 102TRIM command, ATA, 16–17TrueCrypt, 216–217, 254–257Trusted Computing Group (TCG), 128TSA certificates, 201ts command, 83, 158–159tsget command, 158Type C interface, USB, 30, 30f

UU.2 interface, NVME, 28, 28fUASP (USB Attached SCSI Protocol), 29,

40–41UDF (Universal Disk Format), 21udevadm tool, 50–51udev system, Linux, 50–51umount command, 54, 207, 232–233,

234, 241unallocated blocks, extracting, 272unique identifiers, 77, 105Universal Disk Format (UDF), 21Universal Serial Bus. See USBunmounting

decrypted filesystem image, 245, 251, 254, 256

filesystems in Linux, 54forensic format image files, 234loop partitions, 232–233VeraCrypt volume, 218virtual images, 236

unsquashfs command, 207URLs, naming conventions for, 79

292 Index

USB (Universal Serial Bus), 29f, 30fcard readers, 18documenting device identification

details, 108flash drives, 17, 17f, 131, 131f, 173, 228listing devices attached to, 104, 105multifunctional devices, 140overview, 29–30serial access to disks, 122–125

USB Attached SCSI Protocol (UASP), 29, 40–41

usb_modeswitch tool, 140useless use of cat (UUOC), 199user-accessible sectors, wiping, 225–226user password, ATA password-protected

disks, 126–127UUOC (useless use of cat), 199

Vvarmon tool, 178VBoxManage tool, 239VDI format, 236, 239–240VeraCrypt, 217–218, 254–257verifying forensic image integrity

GPG encryption, 213manual creation of SquashFS

container, 207mismatched hash windows, 199–200OpenSSL encryption, 214overview, 197recalculating hash, 198–199signature and timestamp, 200–202split raw images, 199verifying hash during acquisition,

197–198VFDecrypt tool, 251VFS (Virtual File System) abstraction

layer, 52VHD format, Microsoft, 241–243vhdiinfo command, 241–242vhdimount command, 242VirtualBox VDI images, 236, 239–240Virtual File System (VFS) abstraction

layer, 52Virtual Machine DisK (VMDK) format,

240–241Vital Product Data (VPD), 112vmdkinfo command, 240

VM images, accessingdislocker package, 244–245Microsoft VHD, 241–243overview, 237QEMU QCOW2, 237–239VirtualBox VDI, 239–240VMWare VMDK, 240–241

VMs, booting subject drive in, 235–237VMWare VMDK format, 240–241VPD (Vital Product Data), 112

Wwear leveling, 15Weinmann, Ralf-Philipp, 251window managers, Linux, 55–56Windows, booting image in VM, 236wiping forensic image data, 224–228World Wide Name (WWN), 111–112write blockers

documenting evidence for use of, 107–108

hardware, 39, 94–97, 94f, 95f, 97fimportance of, 93–94for legacy interfaces, 34Linux forensic boot CDs, 99media with physical read-only modes,

100, 100fNVME, 28–29overview, 21software, 97–99, 108for USB devices, 30when mounting filesystems, 54

WWN (World Wide Name), 111–112

XX11 window system, Linux, 55Xen blktap xapi interface, 241xHCI (Extensible Host Controller

Interface), 29–30xmount tool, preparing boot images with,

235–237

Zzcat tool, 189, 196, 199ZIP archive format, 211zuluCrypt, 217