Re: Converting an external hard drive enclosure into a write blocker? Nov 25 2007 05:49AM
Krassimir Tzvetanov (krassi krassi biz) (1 replies)
Re: Converting an external hard drive enclosure into a write blocker? Nov 26 2007 09:17PM
David Kovar (kovar netcerto com)

First off, use a hardware write blocker if you really want to be
certain nothing is going back to the drive.

Then, you can cover all the bases quite neatly by making multiple
forensic copies of the evidence disk. Allow one to mount "normally".
Mount one with a write blocker. Mount one with a different kernel.
Mount one .... Etc. Compare and contrast ...


On Nov 24, 2007, at 9:49 PM, Krassimir Tzvetanov wrote:

> Well this is a little one sided.
> When you are preserving a hard disk you want a snapshot in the moment
> it was seized. This would mean that you should not do any alteration
> after that point and I'll ask you to consider two cases that will show
> you where I come from.
> 1. The journal replay may overwrite some chunks of data you may want
> to have linked the way they were. I.e. somebody did "rm -rf /" the
> moment the agents were serving a no know warrant (and if they turned
> off the machine the files will be still linked).
> 2. The kernel of the system you are running may have a bug that may
> result in a different behavior than the system being investigated. (or
> vice versa the system may had "special patches" applied that might
> cause your data replay to corrupt data.
> Even further think about a patch that ignores certain records of the
> journal file and those records when applied by a "unpatched kernel"
> unlink certain files (or overwrite them with random data).
> You should also do separate analysis on the journal itself to
> determine what contents it contains.
> Having said all that I do not reject the ability to present as a
> separate evidence replayed journal (*and note you did that*) to the
> investigators/court.
> Regards,
> Krassi

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus