Assignment 5
Names:
1. Omar Mohamed Kareem
2. Omar Osama
3. Ahmed Bassem
4. Eslam Ahmed Helmy
1. Common Forensic Acquisition Tools
Digital forensic tools are used to create bit-stream copies (images)
of evidence without altering the original data.
Tool Type Key Features
Industry standard; excellent
EnCase
Commercial for enterprise environments
(OpenText)
and automated reporting.
Commercial Primarily used for creating
FTK Imager
(Free version forensic images and mounting
(AccessData)
available) them; very fast and stable.
A GUI-based tool that is free
Autopsy /
Open Source and modular; great for
Sleuth Kit
analyzing disk images.
Tool Type Key Features
Command-line tools (primarily
Open Source
DC3DD / DD Linux) used for low-level, bit-
(CLI)
for-bit cloning.
Comparison: Commercial tools like EnCase and FTK offer more
streamlined interfaces and tech support but come with high
licensing costs. Open-source tools like Autopsy are highly
customizable and free but may require more technical expertise to
manage via command line.
2. Common Forensic File Formats
When acquiring data, it must be saved in specific formats that
maintain integrity (usually through hashing).
Size /
Format Type Platform Conversion
Compression
Easy to
Raw (.dd / Uncompressed;
Bit-stream Universal convert to
.img) large size.
any format.
Supports
Expert Standard;
Proprietary compression; Windows/Major
Witness widely
(EnCase) metadata Tools
(.E01) supported.
storage.
Size /
Format Type Platform Conversion
Compression
Advanced Metadata & Can be
Open
Forensic compression; no Cross-platform converted to
Source
(.AFF) size limit. Raw/E01.
High
Less
SMART compression;
Linux-based Linux / ASRData common in
(.S01) metadata
Windows.
support.
3. Data Acquisition Methods
There are different ways to gather evidence depending on
whether the system is running or shut down.
• Static Acquisition: Used when the device is powered off. It
involves taking a bit-stream image of the hard drive. This is
the most reliable method as it preserves all deleted files and
unallocated space.
• Live Acquisition: Used when a computer is powered on and
encryption or volatile data (RAM) is a concern. It captures
data that would be lost if the machine were turned off (like
running processes or chat logs).
• Sparse Acquisition: Only captures specific fragments of data
or deleted files rather than the whole drive.
• Logical Acquisition: Only captures visible files and folders
(e.g., specific documents or email archives), often used for
large servers where imaging the entire disk is impractical.
Comparison: Static is the gold standard for court evidence, but
Live is increasingly necessary due to the rise of full-disk encryption
and cloud storage.
4. RAID and RAID Servers
RAID (Redundant Array of Independent Disks) is a technology
used to increase data reliability and performance by using
multiple hard drives.
Common RAID Levels:
• RAID 0 (Striping): Splits data across drives. High
performance, but zero redundancy (if one drive fails, all data
is lost).
• RAID 1 (Mirroring): Duplicates data on two drives. If one
fails, the other has a perfect copy.
• RAID 5 (Striping with Parity): Requires at least three drives.
It offers a balance of performance and protection by
spreading "parity" data across all disks.
• RAID 10: A combination of RAID 1 and RAID 0, offering high
speed and high redundancy.
RAID Servers:
A RAID Server is a specialized server designed to handle massive
amounts of data with high uptime. In forensics, RAID servers are
challenging because the data is "striped" across many disks. To
analyze them, a forensic investigator often has to reconstruct the
RAID virtual volume using specialized software before they can
begin the investigation.