Freelancing as a Di...
 
Notifications
Clear all

Freelancing as a Digital Forensics Examiner

16 Posts
7 Users
2 Likes
2,328 Views
kastajamah
(@kastajamah)
Posts: 109
Estimable Member
 
Posted by: @jaclaz

[2] IMHO even more relevant from an ethical/educational point of view is that IF Doe bid for the project  AND he needs suggestions on how to do the very basic first steps of what he bid for (and won) THEN he is an impostor (and NOT a Digital Forensics Examiner)

 

I couldn't have said it better myself.

 
Posted : 11/06/2020 12:33 pm
(@nerimatrixx)
Posts: 26
Eminent Member
Topic starter
 
Posted by: @jaclaz

Sure, and that is where "forensic sound" boot disks (please read as CD/DVD and/or USB sticks) come handy.

This option was considered as well. We have done this on several mock scenes, but that's only after the Boot Sequence of the computer was change to HDD last.

Most computers today will check the HDD first for a bootable partition, since CD/DVD Drive are no longer standard peripheral device.

How realistic it is do a 500GB acquisition if Tesh use a crossover cable + EnCase WinAcq or LinEn (or some other tool), how many hours would it take?

 
Posted : 11/06/2020 3:54 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 
Posted by: @nerimatrixx

This option was considered as well. We have done this on several mock scenes, but that's only after the Boot Sequence of the computer was change to HDD last.

Most computers today will check the HDD first for a bootable partition, since CD/DVD Drive are no longer standard peripheral device.

How realistic it is do a 500GB acquisition if Tesh use a crossover cable + EnCase WinAcq or LinEn (or some other tool), how many hours would it take?

Well, that is why I talked also of USB, if the computer cannot boot from USB, it would be a strange today computer, but  - out of curiosity - how EXACTLY do you plan to run WinAcq or LinEn?

A crossover cable connected on one end to the computer and the other hand to what?

jaclaz

 
Posted : 11/06/2020 4:26 pm
(@rich2005)
Posts: 535
Honorable Member
 
Posted by: @nerimatrixx
Posted by: @jaclaz

Sure, and that is where "forensic sound" boot disks (please read as CD/DVD and/or USB sticks) come handy.

This option was considered as well. We have done this on several mock scenes, but that's only after the Boot Sequence of the computer was change to HDD last.

Most computers today will check the HDD first for a bootable partition, since CD/DVD Drive are no longer standard peripheral device.

How realistic it is do a 500GB acquisition if Tesh use a crossover cable + EnCase WinAcq or LinEn (or some other tool), how many hours would it take?

If you're on a gigabit NIC at both ends then it'll probably only limit the drive a bit (bearing in mind a 500gb drive, assuming you're not talking an SSD, is probably not particularly modern or high-speed).

 
Posted : 11/06/2020 7:14 pm
Mark_Eskridge
(@mark_eskridge)
Posts: 50
Trusted Member
 

Please do Doe a favor and suggest they hire a subcontractor in Canada to do the forensic collection. Both parties will be better off.

 
Posted : 11/06/2020 8:36 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 
Posted by: @mark_eskridge

Please do Doe a favor and suggest they hire a subcontractor in Canada to do the forensic collection. Both parties will be better off.

Well, said.

@Rich2005

The list of expenses is growing.

Till now Tesh was spending:
1) an undisclosed amount of money for Doe's services
2) some 2-10 US$ for a CD/DVD or USB stick
3) some 80-120 US$ for an external USB disk

Hence I asked about what is supposed to be on the other end of the crossover cable, if - at it should be - it is a (forensic) laptop we have to add:
4) some 2-5 US$ for a crossover cable [1]
5) some 500-2000 US$ for a laptop 

jaclaz

[1] since we are talking of GB lan, AFAIK they are all auto-switch so a normal lan cable should do instead of the cross-over one.

 

 
Posted : 12/06/2020 7:11 am
Page 2 / 2
Share: