Lect99 - Special Questions

Question 1

What are the steps when you would like to acquire a media?

Answer 1

1. Prep target disk => # dc3dd wipe=/dev/sdb
2. Check available disk space: # df -h
3. Create dest folder: # mkdir /mnt/evidence
4. Boot suspect with linux boot disk
5. Mount target disk
6. Check source drive: # lsblk or lsscsi or lsusb
7. Collect media details: # hdparm -I /dev/sdX
8. Hash source media: # sha1sum /dev/sdX
9. Collect evidence: # dd or # dc3dd or # ewfacquire