Updated Forensic Acquisition explained
## SLIDE 1 & 2 — What is this module about?
**Data Acquisition** = **Copying evidence from a device** so police/investigators can examine it
without touching the original.
Topics covered: storage formats, acquisition methods, hashing, and tools.
---
## SLIDE 3 — 3 Ways to STORE Copied Evidence
**1. Raw Format**
→ Just a plain exact copy of the drive. No extra info attached. Simple but needs separate
validation.
**2. Proprietary Format**
→ Special format made by specific tools like EnCase. Only that tool can read it properly.
**3. AFF (Advanced Forensics Format)**
→ A smarter format that stores the copy AND extra info (metadata) about it together in one file.
---
## SLIDE 4 — 3 Types of Data Acquisition
| Type | Simple Meaning |
|---|---|
| Static | Computer is OFF when copied |
| Live | Computer is ON when copied |
| Logical/Sparse | Copy only specific files, not everything |
---
## SLIDE 5 — Static Acquisition
- Done when police **seize a computer** (e.g., during a raid)
- Computer is **switched off** → you copy the hard drive
- **Most preferred** method because it's safe and clean
- You already have the device and know the passwords
- **Big limitation:** You miss everything that was running live — like what was open in RAM or
the browser at that exact moment
> 🧠 Think of it like: taking a photo of a crime scene after everyone has left.
---
## SLIDE 6 — Live Acquisition: When Do You Use It?
Use it when:
- Someone is **actively hacking** the network right now
- You think the attacker will **delete evidence** if the computer is turned off
- You need **RAM contents** (RAM is wiped the moment power is cut)
- You **don't know the password** to log in normally
> 🧠 Think of it like: recording a crime scene while it's still happening.
---
## SLIDE 7 — Live Acquisition: Step-by-Step
1. **Make a bootable USB/CD** using WinFE tool
2. **Write down every action** you take (important for court)
3. **Send collected data to a network drive** (safest place)
4. **Copy the RAM first** (it disappears when power is off)
5. **Investigate further** based on the case — check for rootkits, firmware changes, or create a
network image
6. **Hash every file** you collect (to prove it wasn't tampered with later)
---
## SLIDE 8 — Logical / Sparse Acquisition
**Logical Acquisition:**
→ Copy only **specific files** needed for the case
→ Example: For email fraud investigation → only copy `.pst` or `.ost` files (email files)
**Sparse Acquisition:**
→ Copy **fragments of deleted data** from unallocated space
**When to use it:**
- Drive is very large (copying everything takes hours)
- You're short on time
- You don't need the whole drive
---
## SLIDE 9 — 4 Methods to Actually Copy Data
| Method | What it means |
|---|---|
| Disk-to-Image file | Copy drive into a single image file |
| Disk-to-Disk | Copy one physical drive to another drive |
| Logical disk copy | Copy only specific files/folders |
| Sparse data copy | Copy only deleted/fragment data |
Best method depends on **the situation** of the investigation.
---
## SLIDE 10 — Best Methods Explained
**Disk-to-Image (Most Common ✅ )**
- Makes an **exact bit-for-bit copy** (every single 0 and 1 is copied)
- Make **more than one copy** — the more the better!
- Tools: ProDiscover, EnCase, FTK, X-Ways, Sleuth Kit
**Disk-to-Disk**
- Used when disk-to-image is **not possible**
- Can adjust drive size/geometry settings
- Tools: EnCase, SafeBack, SnapCopy
---
## SLIDE 11 — Things to Consider When Copying
- **Big drive?** → Use **lossless compression** (shrinks file size without losing any data)
- Use **digital signatures** to verify the copy is genuine
- Also think about: How much time do you have? Can you keep the original disk? Where is the
evidence stored?
---
## SLIDE 12 — New Platforms for Data Acquisition
Forensics today isn't just hard drives! Investigators must also deal with:
-☁️ **Cloud** → Find the right data center first; face legal challenges with Cloud Service
-
-
🌐
Providers (CSP)
📱 **Online Social Networks (OSNs)** → Facebook, Instagram, Twitter etc.
**Smartphones** → Messages, contacts, photos, videos, browser history, app data
---
## SLIDE 13 — Contingency Planning (Backup Plans)
- Always make **at least 2 copies** using **different tools**
- Also copy the **HPA (Host Protected Area)** — a hidden section of a hard drive most tools
miss → use a hardware tool that accesses at BIOS level
- **Encrypted drives (BitLocker)** make static acquisition harder → you may need the user to
give you the decryption key
---
## SLIDE 14 — Hashing the Data
- Hashing ensures **evidence integrity** — proof it wasn't changed
- Most forensic tools (like **Autopsy**) have built-in hashing
- Raw format images have **no metadata** → you must validate them manually
- Hex editors also help ensure integrity
---
## SLIDE 15 — Validating Data Acquisitions
**What is a hash?**
→ A mathematical function that takes any file → produces a **fixed-length unique code**
> 🧠
code.
Like a fingerprint for a file. Change even one letter in the file → completely different hash
**Common algorithms:**
| Algorithm | Security Level |
|---|---|
| CRC-32 | Basic |
| MD5 | Medium |
| SHA-1 | Good |
| SHA-256/512 | Very Strong ✅|
---
## SLIDE 16 — RAID Data Acquisitions
**RAID** = Multiple hard drives working together as one system
Why it's hard to acquire:
- Complex design and configuration
- Can have **terabytes** of data → takes very long
- How disks are arranged (striped/mirrored) adds technical complexity
---
## SLIDE 17 — Remote Network Acquisition
- You can copy data from a suspect's computer **over the internet/network** without being
physically present
- Tools vary in capability
**Problems:**
- Suspect's **antivirus/firewall** might block your remote access tool
- Suspect might have installed **their own security tools** that alert them when someone tries to
access remotely
---
## SLIDE 18 — Why Hashing is Important
Two key reasons:
**1. Data Integrity during transfer**
✅
→ Generate hash before sending → compare hash after receiving → if they match, nothing was
changed
**2. Evidence Immutability**
→ Even the **tiniest change** to a file = completely different hash
→ Forensic tools can instantly detect if someone tampered with evidence
→ This is what makes evidence admissible in court
---
## SLIDE 19 — Validating with Hex Editors
**WinHex** is an advanced hex editor that lets you:
- Hash **specific files or individual sectors** (not just the whole drive)
- **Find suspicious files** that criminals renamed to look like safe/innocent files — by comparing
hash values
> 🧠 Example: A criminal renames `[Link]` → `[Link]`. The hash won't match any real
photo — caught!
---
## SLIDE 20 — Windows Acquisition Tools
**Advantages:**
- Convenient to use
- Works well with hot-swappable devices (plug in/out without restarting)
**Disadvantages:**
- Must use a **write-blocker** hardware device (prevents accidentally writing anything to
evidence drive)
- Can't access the **HPA** (hidden area of drive)
- Some countries **don't legally accept** write-blocking devices
---
## SLIDE 21 — Mini-WinFE Boot Drive
- A tool that lets you boot a suspect's computer from a **USB or CD**
- All connected drives are automatically **read-only** (safe — you can't accidentally modify
evidence)
- After booting, you switch **your own target USB** to read-write mode to run the acquisition
program
---
## SLIDE 22 — FTK Imager Lite
- Part of the **AccessData Forensic Toolkit**
- Used to **view evidence disks** and create **disk-to-image copies**
- Can copy at both:
- **Logical level** (just the partition/files)
- **Physical level** (the entire physical drive)
- Can split the image into segments
- Requires a **write-blocker** OR must be run from Mini-WinFE
---
## SLIDES 23 & 24 — 10 Basic Steps for ALL Forensic Cases
| Step | What to do |
|---|---|
| 1 | Use freshly wiped, virus-free media for your target drive |
| 2 | List all hardware; note the condition of the seized computer |
| 3 | Remove original drive; check CMOS date & time |
| 4 | Record exactly how you acquired the data |
| 5 | Process the drive carefully and logically |
| 6 | List every folder and file on the image |
| 7 | Examine contents of all data files |
| 8 | Recover password-protected file contents |
| 9 | Identify unknown executable files using hash comparison |
| 10 | Maintain control of all evidence at all times |
---
## ⚡ Super Quick Summary (Remember This!)
| Concept | One Line |
|---|---|
| Static Acquisition | Computer OFF → copy storage |
| Live Acquisition | Computer ON → copy RAM + running data |
| Logical/Sparse | Copy only specific or deleted files |
| Hashing | Fingerprint of a file → proves nothing changed |
| Write Blocker | Hardware that prevents modifying evidence |
| Mini-WinFE | Boot USB that mounts drives as read-only |
| FTK Imager | Tool to create disk image copies |
| RAID | Multiple drives together → hard to acquire |