Practical Forensic Imaging: Securing Digital Evidence with Linux Tools

A fresh digital forensics book by Bruce Nikkel is announced. It’s entitled “Practical Forensic Imaging: Securing Digital Evidence with Linux Tools” and is expected to be published in August 2016.

Forensic image acquisition is an important part of post-mortem incident response and evidence collection. Digital forensic investigators acquire, preserve, and manage digital evidence to support civil and criminal cases, examine organizational policy violations, resolve disputes, and analyze cyber attacks. Practical Forensic Imaging takes a detailed look at how to secure and manage digital evidence using Linux-based command line tools. This essential guide walks you through the entire forensic acquisition process and covers a wide range of practical scenarios and situations related to the imaging of storage media.

You’ll learn how to:

• Use Linux and command line tools to perform to forensic imaging of magnetic hard disks, SSD and flash, optical discs, magnetic tapes, and legacy technologies
• Protect attached evidence media from accidental alteration and modification by using hardware and software write blockers, and ensuring read-only access
• Manage large forensic image files, storage capacity planning, image format conversion, compression, splitting, duplication, secure transfer and storage, and secure disposal
• Preserve and verify evidence integrity with cryptographic hashing and piece-wise hashing, public key signatures, and RFC-3161 time-stamping
• Work with new drive and interface technologies such as NVME, SATA Express, 4K-native sector drives, Hybrid SSDs, SAS, UASP/USB3x, Thunderbolt, and more
• Manage drive security such as ATA passwords, encrypted thumb drives, Opal self encrypting drives, Bitlocker, FileVault, Truecrypt, and others
• Acquire usable images from more complex or challenging situations such as RAID systems, virtual machine images, and damaged media