Practical Forensic Imaging

Securing Digital Evidence with Linux Tools
by Bruce Nikkel

September 2016, 320 pp.
ISBN: 978-1-59327-793-2
Contents | Reviews | Updates

  • Download Chapter 2: Linux as a Forensic Acquisition Platform

    Forensic image acquisition is an important part of postmortem incident response and evidence collection. Digital forensic investigators acquire, preserve, and manage digital evidence to support civil and criminal cases; examine organizational policy violations; resolve disputes; and analyze cyber attacks.

    Practical Forensic Imaging takes a detailed look at how to secure and manage digital evidence using Linux-based command line tools. This essential guide walks you through the entire forensic acquisition process and covers a wide range of practical scenarios and situations ­related to the imaging of storage media.

    You’ll learn how to:

    • Perform forensic imaging of magnetic hard disks, SSDs and flash drives, opti­cal discs, magnetic tapes, and legacy technologies
    • Protect attached evidence media from accidental modification
    • Manage large forensic image files, storage capacity, image format conversion, compression, splitting, duplication, secure transfer and storage, and secure ­disposal
    • Preserve and verify evidence integrity with cryptographic and piecewise hashing, public key signatures, and RFC-3161 ­timestamping
    • Work with newer drive and interface tech­nologies like NVME, SATA Express, 4K-native sector drives, SSHDs, SAS, UASP/USB3x, and Thunderbolt
    • Manage drive security such as ATA pass­words; encrypted thumb drives; Opal self-encrypting drives; OS-encrypted drives using BitLocker, FileVault, and TrueCrypt; and others
    • Acquire usable images from more complex or challenging situations such as RAID systems, virtual machine images, and damaged media

    With its unique focus on digital forensic acquisition and evidence preservation, ­Practical Forensic Imaging is a valuable resource for experienced digital forensic investigators wanting to advance their Linux skills and experienced Linux administrators wanting to learn digital forensics. This is a must-have reference for every digital forensics lab.


  • About the Author

    Bruce Nikkel is the director of Cyber-Crime / IT Investigation & Forensics at a global financial institution where he has managed the IT forensics unit since 2005. He is an editor for Digital Investigation and has published ­research on various digital forensic topics. Bruce holds a PhD in network forensics.


    Table of Contents

    Introduction

    Chapter 0: Digital Forensics Overview
    Chapter 1: Storage Media Overview<
    Chapter 2: Linux as a Forensic Acquisition Platform
    Chapter 3: Forensic Image Formats
    Chapter 4: Planning and Preparation
    Chapter 5: Attaching Subject Media to an Acquisition Host
    Chapter 6: Forensic Image Acquisition
    Chapter 7: Forensic Image Management
    Chapter 8: Special Image Access Topics
    Chapter 9: Extracting Subsets of Forensic Images

    View the detailed Table of Contents (PDF)
    View the Index (PDF)

    (top)

    Reviews

    “Despite the huge impact of this subject matter, there have been precious few books on the topic to date. Luckily, Practical Forensic Imaging steps in now to fill the gap. An excellent addition to any bookshelf.”
    Forensic Focus

    “I am a big fan of this book, and found it to contain the right amount of technical content coupled with important concepts and concerns surrounding forensic imaging. I’d encourage anyone in DFIR who is imaging regularly or looking to increase their Linux skills to check out a copy of the book.”
    505 Forensics

    The International Society of Forensic Computer Examiners (ISFCE) added Practical Forensic Imaging to their list of suggested study materials!

    Practical Forensic Imaging is featured on Linux Journal.

    “Cybercrime and digital forensics expert Bruce Nikkel describes the use of open source command line technology to obtain and manage forensic data. Target readers are the expanding number of forensic practitioners including forensic and electronic discovery technicians in legal, auditing, and consulting firms; incident response teams; law enforcement forensic specialists; and forensic investigators.”
    The Lawyer's PC

    (top)