The first step in the forensic examination of a computer hard drive is almost always the creation of a "bit level" copy, or image, which includes every bit of information on the disk regardless of whether or not it is part of an existing file system. The creation of this image serves to provide a platform that can be subjected to in-depth analysis without fear of altering the original evidence. A number of tools are commonly used by investigators to perform forensic imaging, the following are some of the most popular:

EnCase: EnCase is a fully featured commercial software package that enables an investigator to image and examine data from hard disks, removable media, and some PDAs. This image can be analyzed in a variety of ways using the EnCase program, common examples of which might include searching the data for keywords, viewing picture files, or examining deleted files. Many law enforcement groups throughout the world use EnCase; this may be an important factor for investigators to consider if there is a possibility that an investigation may be handed over to the police or used in a court of law.

SafeBack: SafeBack is another commercial computer forensics program commonly used by law enforcement agencies throughout the world. SafeBack is used primarily for imaging the hard disks of Intel-based computer systems and restoring these images to other hard disks. It is a DOS-based program that can be run from a floppy disk and is intended only for imaging; in other words, it does not include the analysis capabilities of EnCase or Vogon's forensic software.

Data dumper (dd): Imaging a computer's hard disk can be a lengthy process but it need not be expensive. dd is a freely available utility for Unix systems that can make exact copies of disks that are suitable for forensic analysis. It is a command line tool and requires a sound knowledge of the command syntax to be used properly. Modified versions of dd intended specifically for use as a forensic utility are also available.

[ Read more ]

Related items

• News: Forensics on the Windows Platform, Part 1 (29 January 2003)