What is Data Acquisition?
Definition: The process of collecting digital evidence from storage media, live
systems, or network sources while preserving integrity and admissibility.
Primary rule: Do not alter the original evidence.
Key considerations:
o Chain of custody
o Write-blocking technology
o Choosing between live or dead acquisition
o Hash verification
Order of Volatility (RFC 3227)
Collect data from most volatile to least volatile:
Priority Data Type Description
1 CPU registers, cache Disappears in nanoseconds
2 RAM (system memory) Lost within seconds to minutes after
power o
3 Network state Connections, ARP table, routing
4 Running processes Process list, handles
5 Disk storage (HDD/SSD) Non-volatile but can be altered by OS
6 Remote logs, backups Least volatile
Example: Encrypted laptop → capture RAM first (contains decryption key), then network
state, then image the drive.
Types of Data Acquisition
Type Description
Physical acquisition Bit-stream copy of entire storage medium (allocated,
unallocated, slack space). Captures deleted files. Required for
thorough analysis.
Logical acquisition Copies only allocated files/folders. Faster, smaller, but misses
hidden/deleted data.
Targeted / sparse Only specific sectors, files, or file types (e.g., registry hives).
Remote / network Over LAN/WAN using agents (F-Response, FTK Imager over
network).
Live memory Captures RAM contents (processes, network connections,
acquisition decryption keys).
Storage Formats for Forensic Images
Format Features
Raw (dd) Simple byte-for-byte copy. No metadata, no compression.
Needs separate hash file.
E01 (EnCase Expert Compression, encryption, embedded metadata (case #,
Witness) examiner, hashes), error recovery. Industry standard.
AFF (Advanced Open standard, compression, encryption, metadata, multiple
Forensic Format) hashes.
VHD / VMDK Virtual machine disks. For virtualised evidence.
Segmentation: Large images can be split into smaller files (e.g., 2 GB chunks) for
FAT32 storage.
Compression: E01 / AFF can reduce image size by 20-40% (even 90% on empty
drives).
Hash verification after imaging is mandatory (MD5, SHA-1, SHA-256).
Acquisition Methods (by Scenario)
Dead Acquisition
System is powered o .
Drive removed or booted from forensic CD/USB.
Use write blocker, then image with dd, dcfldd, FTK Imager.
Advantage: Suspect OS never runs – evidence pristine.
Live Acquisition
System is running.
Capture RAM first, then network state, then logical files.
When required:
o Full disk encryption (key in RAM)
o Critical server cannot be rebooted
o Need evidence of active processes/connections
Remote Acquisition
Enterprise/cloud servers.
Agent provides read-only access over secure connection.
Tools for Data Acquisition
Write Blockers (Essential)
Hardware: Tableau, WiebeTech. Sit between drive and workstation – most reliable.
Software: OS-level (hdparm -r 1 on Linux, diskpart on Windows). Less secure, only
as secondary.
Bootable Forensic Disks
CAINE, Kali Linux (Forensics mode), Paladin, REMnux.
Boot from USB/CD – bypasses suspect OS. Includes write blocking and imaging
tools (dcfldd, guymager).
Limitation: Cannot read encrypted drives without key.
Non-Writable USB
USB drives with physical write-protect switch.
Use to store collected outputs (memory dumps, logs) without risk of modification.
FTK Imager (Free, Windows)
Create physical/logical images (raw, E01, AFF).
Generate/verify hashes.
Capture RAM from live system.
Mount images as read-only drives.
Preview files without imaging.
Validating Evidence – Hashing
Purpose: Prove that the image is identical to the original source.
Common hash algorithms:
o MD5 (128-bit) – fast but weak for collisions – still acceptable for integrity.
o SHA-1 (160-bit) – deprecated.
o SHA-256 (256-bit) – recommended.
Best practice: Store both MD5 and SHA-256.
When to Validate
Before acquisition (hash original)
During acquisition (tool computes in real time)
After acquisition (hash image)
After transfer to another location
Before analysis
After analysis
What if hashes don’t match?
Do NOT proceed.
Re-acquire from original source.
If original is lost, document failure – evidence likely inadmissible.
Chain of Custody & Documentation
Every acquisition must have a forensic log containing:
o Date, time, timezone
o Examiner name
o Evidence description (make, model, serial number, capacity)
o Acquisition method and tool (with version)
o Hash values (original and image)
o Bad sectors / errors
Store image on write-protected media (e.g., WORM NAS or evidence bag).