SANS Digital Forensics and Incident Response Blog: Category - Evidence Acquisition

First Response: Recovering a Dying Hard Drive

By David Hoelzer
Enclave Forensics

So there I was, happily working away, when Time Machine pops up and tells me, "Time Machine has not successfully completed a backup in 18 days." "That's strange," I thought, and proceeded to look into what could possibly be wrong.

I won't bore you with my deep satisfaction with Macs and Time Machine. That's not what this article is about. However, what I discovered was that Time Machine was failing to mount the sparse bundle in which the backup is stored. After poking at this for a couple of minutes I decided to simply reformat the Time Machine partition and be done with it.

After doing


Robocopy - a Computer Forensics tool?

The usual practice for obtaining potential evidence would be to acquire a bit for bit forensic image of the drive and to lock the image up in an evidence safe. Depending upon the legal team's request, one may also replace the original hard drive and keep it in the safe instead of just an image. Another option I like is having a third party acquire the drive on our behalf and keep it in their secure area for us. Sometimes, however, for various reasons, a forensic image may not be feasible. So, then, what is another option?

In a recent e-mail exchange with Rob Lee, I asked him what he thought about using

NCS vs DRN - Taking Notes

Intro to Notes

If computer forensics is to be taken as a science, a key requirement is that results be repeatable. A key part of repetition is the quality of your notes.

Notes are an important aspect of an investigation. No matter how good of a memory you have, something is bound to slip through the cracks at some point. Take the size of some investigations, the length of time it may take before anyone takes action on your report, and the size of many case loads and a lack of notes can be a recipe for disaster. On the other hand, note taking style is a big matter of personal preference with no industry standard way of approaching the situation. I thought we might talk a bit about different options and problems that come from note taking, and hope that some others will chime in with how they approach the problem.


First question that comes up with note taking, is where do you want to do it? Low tech has some

... Continue reading NCS vs DRN - Taking Notes

Searches and the US 4th Amendment

In much of the common law world (including the USA, UK, Canada, NZ and Australia), law enforcement needs to obtain a legal authorization in order to search and seize evidence. Generally, this power is granted through a request for a search warrant which states the grounds for the application including the law which has been broken. In the United States and the United Kingdom the requirements further require that the application describes the specific premises to be searched as well as the items being sought.

In the US, the Fourth Amendment and the Electronic Communications Privacy Act (ECPA) determine the lawfulness of a search. The Fourth Amendment only applies to government searches (such as those conducted by law enforcement officials). The ECPA applies to everyone (whether government or private) and


Learning Curve: Carving Partitions Out of Compressed AFF Disk Images

Due to my supervisor's reluctance to purchase more drive space (now it's a financial crisis), I recently embarked on a quest to put my disk images on a diet by switching from RAW to compressed AFF images. Arguably, I should have done this moons ago, but as I recently discovered, some things are easier with RAW images.

One obstacle appeared when I wanted to carve out a partition from a full disk image. My image file (P0wnedDisk.AFF) contained a Dell Utility partition and a Windows boot partition. For this case, I was only interested in the Windows partition, so I wanted to carve it out and save it to a separate compressed AFF file (P0wnedPartition.AFF). Unless I've missed something (it turns out, I had... read on), there's no way to do this with AFF Tools alone.

After many listserv posts, cries for help, and prayers to divine entities, I cobbled together the following