±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 7
Overall: 27351
Visitors: 48

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Encrypting Acquisition Drives?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3  Next 
  

Encrypting Acquisition Drives?

Post Posted: Wed Feb 27, 2013 5:36 pm

I was curious if anyone had thoughts about encrypting acquisition drives to protect evidence? We primarily image a drive to a file. After the image is complete use a hardware Encryptor to encrypt the evidence drive. Thus using a virtual lock and key to add an additional layer of security to the evidence before it is processed in the lab.

Please let me know your thoughts.


Tom  

gentekkresearch7
Member
 
 
  

Re: Encrypting Acquisition Drives?

Post Posted: Wed Feb 27, 2013 5:57 pm

If your lab is secure why bother. Encryption just slows everything down and adds little benefit unless you are sending data out of the lab. Or are working on something so sensitive that all possible precautions need to be taken - this is very rare in my experience.
_________________
Paul Sanderson
Forensic Toolkit for SQLite
sandersonforensics.com...ic-Toolkit
www.twitter.com/sandersonforens
www.facebook.com/recon...resoftware 

PaulSanderson
Senior Member
 
 
  

Re: Encrypting Acquisition Drives?

Post Posted: Wed Feb 27, 2013 5:59 pm

Paul,

That is a good point. I was just toying with the notion. All evidence is locked in a secure evidence room.

Thanks,

Tom  

gentekkresearch7
Member
 
 
  

Re: Encrypting Acquisition Drives?

Post Posted: Wed Feb 27, 2013 8:55 pm

We typically encrypt our destination drives with TrueCrypt. We're shipping evidence cross country on a regular basis, though, so there is definitely a need.

Any insight into the discrepancy between transfer times using encrypted vs. non-encrypted destination media?  

slamdek
Newbie
 
 
  

Re: Encrypting Acquisition Drives?

Post Posted: Wed Feb 27, 2013 9:24 pm

- slamdek
We typically encrypt our destination drives with TrueCrypt. We're shipping evidence cross country on a regular basis, though, so there is definitely a need.?


My thoughts precisely, I only encrypt if the hard drive is being shipped by someone other than me, otherwise really no point.  

Adam10541
Senior Member
 
 
  

Re: Encrypting Acquisition Drives?

Post Posted: Thu Feb 28, 2013 1:33 am

> If your lab is secure why bother.
Because disks have a tendency to leave the lab, sooner or later.

> Any insight into the discrepancy between transfer times using encrypted vs. non-encrypted destination media?

HIghly depends on the solution. Software based encryption can have a significant performance impact.

You can also use hardware encryption e.g. those of Addonics www.addonics.com/
which offer an encryption solution with little to none speed impact.  

joachimm
Senior Member
 
 
  

Re: Encrypting Acquisition Drives?

Post Posted: Thu Feb 28, 2013 6:38 am

We encrypt all acquisition drives with TrueCrypt as standard. There are two principal reasons for this:

[1] We sometimes have to ship disks. Sure, I could encrypt them when I need to ship them, but usually there's some kind of urgency at that stage, so I'd rather they were ready to go.

[2] Some of what we acquire is considered to be 'Personal Data' within the meaning of relevant Data Protection laws. Our Data Processing agreements with out clients typically require us to take 'technical and organizational measures' to protect such data: encrypting the data is one part of that.  

pragmatopian
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 3
Go to page 1, 2, 3  Next