Notifications
Clear all

USB Drives & CD/DVD

4 Posts
4 Users
0 Reactions
539 Views
(@paulodicanio)
Eminent Member
Joined: 19 years ago
Posts: 36
Topic starter  

Any good links or advise on imaging these devices in a forensically sound manner. I cant see how either could be protected by fastbloc le or fe?


   
Quote
(@Anonymous)
Guest
Joined: 1 second ago
Posts: 0
 

For USB drives you may wish to try ForensicPC's Ultimate Write Block Kit.. For imaging, I have successfully used Helix. If you're more comfortable with Linux and command-line operations, you may wish to mount the USB drive as RO (It should show up as /dev/sda or some-such) and then run DCFLDD to image and create hashes on-the-fly.

For CD/DVD, I would think a read-only drive would well to ensure nothing is written the the subject disk.


   
ReplyQuote
(@tomasreilly)
Active Member
Joined: 20 years ago
Posts: 5
 

Hi
With cds and dvds (read only memory) the easiest method is to use EnCase to image them and / or isobuster to preview them. If they are re writable, you would still require burning software to change anything on the media so by placing the cd / dvd in the drive it is still regarded as being forensically sound.


   
ReplyQuote
(@bithead)
Noble Member
Joined: 20 years ago
Posts: 1206
 

I have always used the CD and DVD Forensics book as my reference. As far as software, EnCase & FTK have somewhat limited capabilities so the afore mentioned ISOBuster or the dedicated CD/DVD Inspector are my tools of choice.

A read only CD/DVD drive is absolutely necessary on any XP, Vista or Mac forensic station as those OSes have CD burning software built-in.


   
ReplyQuote
Share: