Forensics
Advice on transferring forensic image Dec 04 2007 12:35PM
Stefan Kelm (stefan kelm secorvo de)
Folks,

one of my cases has been going on for almost half a year
now. Unfortunately, I now do have the need to transfer
the forensic dd image to another target disk which will
then become the case disk.

Is there anything other than the usual stuff (securely
erase the 'new' disk, create checksums before copying,
transfer the image using dcfldd, create checksums after
copying, securely erase the 'old' disk, document the whole
process) which needs to be done?

Am I missing anything important here?

Cheers,

Stefan.

--------------------------------------------------------
T.I.S.P. - Lassen Sie Ihre Qualifikation zertifizieren
vom 25.-29.02.2008 - http://www.secorvo.de/college/tisp/
--------------------------------------------------------
Stefan Kelm
Security Consultant

Secorvo Security Consulting GmbH
Ettlinger Strasse 12-14, D-76137 Karlsruhe
Tel. +49 721 255171-304, Fax +49 721 255171-100
stefan.kelm (at) secorvo (dot) de [email concealed], http://www.secorvo.de/
PGP: 87AE E858 CCBC C3A2 E633 D139 B0D9 212B

Mannheim HRB 108319, Geschaeftsfuehrer: Dirk Fox

-----------------------------------------------------------------
Uncover stealthy Trojans and malware in corporate web traffic
Anti-virus and URL filtering solutions provide only a limited solution to evasive crimeware.
Qualify for a free audit for enterprises
www.finjan.com/RUSafe

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus