Digital forensic process: Difference between revisions

Revision as of 22:52, 3 August 2018

Revision as of 01:01, 4 August 2018

Line 40:

[[File:Tableau TD3 Forensic Imager 2014-06-26 07-05.jpg|thumb|Example of a portable disk imaging device]]

Once exhibits have been seized, an exact [[Disk sector|sector]] level duplicate (or "forensic duplicate") of the media is created, usually via a [[Forensic disk controller|write blocking]] device. The duplication process is referred to as ''[[Disk imaging#Hard drive imaging|Imaging]]'' or ''Acquisition''.<ref name="horenbeeck"/> The duplicate is created using a hard-drive duplicator or software imaging tools such as [[DCFLdd]], [https://www.cru-inc.com/ditto/ Ditto Forensic FieldStation]<ref>{{cite news |last1=Breeden II |first1=John |title=Forensic FieldStation brings stealth to hard drive data capture |url=https://gcn.com/articles/2013/05/03/forensic-fieldstation-stealth-hard-drive-data.aspx |accessdate=3 August 2018 |agency=GCN |date=5/3/ May 2013}}</ref>, [[IXimager]], [[Guymager]], TrueBack, [[EnCase]], [[Forensic Toolkit|FTK]] Imager or FDAS. The original drive is then returned to secure storage to prevent tampering.

The acquired image is verified by using the [[SHA-1]] or [[MD5]] [[cryptographic hash function|hash function]]s. At critical points throughout the analysis, the media is verified again to ensure that the evidence is still in its original state. The process of verifying the image with a hash function is called "hashing."