Lab1 - Forensic Imaging & Data Acquisition

Lab1 - Forensic Imaging & Data Acquisition

1. Tools & Utilities

   • Linux Commands
     • lshw
       • a command for listing hardware in Linux
     • mount
       • a command to mount devices in Linux
     • dc3dd
       • developed by DoD
       • assist in forensic acquisition of hard drives and other media
       • hashing
       • error detection
       • enhanced logging
       • verification
       • secure deletion
       • a modified version of the Linux dd archiving utility
     • ewfacquirestream
       • takes a stream of data and convert it into an ewf container
       • this utility is often used with dc3dd to convert raw images to ewf format