Forensic process from live examination to acquisition

Assignment Help HR Management

Reference no: EM133974021

Question

Workshop: Digital Discovery with Bootable CDs.

Abstract

Boot-CDs are a flexible and powerful method to assist in the whole forensic process from live examination to acquisition, searching and recovery. Linux was ever since the most popular OS for this purpose, but in some cases Windows-based live-CDs are also useful. In this workshop we present different real-life case scenarios and the corresponding live-boot-solution. Since kernel 2.6 Linux is able to create forensically sound images even of partitions/harddisks with odd sectors. But one has to be aware of a lot of other circumstances which can alter the evidence: mounting filesystems, automatic activation of software RAID arrays, using LVMs or swap-space on the target disk. A lot of Linux-boot-CDs seem to take care of all the critical points, but in fact there are only few well documented tests available. Another problem of the ready-to-download Linux live-CD images is the lack of support for brand new hardware. So a framework to build a custom Linux-live-system with current kernel versions and packages would be really helpful. We present grml, a Debian based live system, developed by the Austrian Debian developer Michael Prokop and the grml team. This system satisfies all the above mentioned initial conditions and much more. Various boot parameters allow to control the behavior of the live system, e.g. the parameter "forensic", which is a shortcut for "nofstab noraid noautoconfig noswap raid=noautodetect readonly ...". Additionally the grml system can be booted from CD/DVD, USB-/firewire-device, remote-adapter (iLO, RSA2, ...), flash-card and PXE. In this workshop you'll learn how to use grml for forensic investigations and how to build your own live system using the grml-live framework. On some brand-new mainboards the grml system might still fail, because the chipset, especially the onboard-raid-chipset is not yet supported by the Linux kernel. For these cases a forensically sound windows-based boot-CD as plan B is needed. So the workshop present a way to build a - forensically sound windows based boot CD using the standard Windows automated installation kit for Windows Vista along with some registry modifications.

What is the research problem (RP) the article addresses?

What is the cause of the discussed RP?

What is/are the impact/s of the RP under discussion?

What are the proposed solutions the article suggests for the RP?

What are the limitations and future works of this research?

Reference no: EM133974021

Questions Cloud

Mobile device vulnerabilities and exploits : The following are examples of mobile device vulnerabilities and exploits.

Tool for e-commerce reporting : Describes a specific e-commerce report, or a tool for e-commerce reporting.

Describes specific e-commerce report : Locate an article that describes a specific e-commerce report, or a tool for e-commerce reporting.

Bob has begun working on risky business plan : Suppose that Bob has begun working on a risky business plan, and decided to regularly send electronic versions of it to his partner Alice

Forensic process from live examination to acquisition : Boot-CDs are a flexible and powerful method to assist in the whole forensic process from live examination to acquisition, searching and recovery.

Describe potential blog that includes information : Describe a potential blog that includes information that is not true.

Role of cybersecurity in information systems : Discuss the role of cybersecurity in information systems. What are the common threats to information security,

Concepts in terms of the types of car models : CEO of Auto Concepts, has begun formulating some concepts in terms of the types of car models to pursue to bring his parent company product line back to life.

Which dashboards would be useful for the investigation : What criticality would you assign to the alert you created? Which Dashboards would be useful for the investigation?

User Account

All Pages