±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36775
New Yesterday: 3 Visitors: 129

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

how to acquire CD / DVD ??

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3  Next 
  

gremodic
Member
 

how to acquire CD / DVD ??

Post Posted: Mar 09, 10 17:37

hi hello to all
excuse if i don't write english very well....

in this period i must acquire many cd & dvd i do this with encase but often there are many errors and so encase is not a good idea.....

can you give me an idea of what can i do and how....

i have used other programs like isobuster or badcopypro for recovery data from cd but how i can give a forensic specification at all??

P.S. I'm really sorry for my english Wink  
 
  

p4c0
Newbie
 

Re: how to acquire CD / DVD ??

Post Posted: Mar 09, 10 18:12

I've used Isobuster and I think it's a good tool also because let's you acquire even the different sessions on a multisession cd, so you don't risk to miss a file that was "deleted" between two sessions.

Paco  
 
  

gremodic
Member
 

Re: how to acquire CD / DVD ??

Post Posted: Mar 09, 10 18:15

yes now i'm trying isobuster in the same minute you answer me, but what i must hash? only the iso generated?

now for example isobuster found a damage sector and ask me if i want replace with null information or jump the sector....i choose the first but now i know that is different from orginal....  
 
  

azrael
Senior Member
 

Re: how to acquire CD / DVD ??

Post Posted: Mar 09, 10 18:50

For various assorted reasons, that I can't honestly remember without looking it up in the course notes, you can _never_ truly image a CD or DVD - you can get a logical copy of content, and it is this, once you have it completely, that you should hash.

Personally, I'd go for NULLs over skipping - as this at least gives the impression of where something _might_ have been.
_________________
--
Azrael
-- 
 
  

gremodic
Member
 

Re: how to acquire CD / DVD ??

Post Posted: Mar 09, 10 18:55

so your counsel is to do an Iso image with one program as isobuster nero kr3b or similar and after hash this? also if this Iso is affect by many errors?  
 
  

dietro
Senior Member
 

Re: how to acquire CD / DVD ??

Post Posted: Mar 09, 10 19:03

FTK Imager which uses, the ISObuster engine, will create an ISO image of a CD/DVD and it will generate a hash for you.  
 
  

azrael
Senior Member
 

Re: how to acquire CD / DVD ??

Post Posted: Mar 09, 10 19:15

Personally I don't use any of those tools - however that's not to say that they aren't perfectly acceptable. I'd be careful if any of the media is rewritable, so as to be sure not to cause any modification to it.

As said above the FTK imager does all the hard work for you ...

Being a UNIX nut, I'd use dd and hash the image ( or dcfldd, which will hash it for you ).

Smile
_________________
--
Azrael
-- 
 

Page 1 of 3
Page 1, 2, 3  Next