CHFI Module 4 Data Acquisition Latest 2024 Graded A+

CHFI Module 4 Data Acquisition Latest 2024 Graded A+ Data acquisition is the process of obtaining, cleaning, organizing, relating, and cataloging source data Live Acquisition acquiring volatile data from a working computer (either locked or in sleep condition) that is already powered on, or IF we know the PW to an encrypted drive Static Acquisition acquiring the non-volatile or unaltered data remains in the system even after shutdown Volatile Data Collection Strategy Devise strategy based on type of data, source(s) of data, type of media, etc.. Volatile Data Collection Setup Establish trusted command shell to minimize footprint and any malware triggers Establish transmission and storage method Ensure integrity of tool output with MD5 hash for admissibility Volatile Data Collection Process Record time, date, command history and do so when using tools/commands Document forensic activities and do not restart or shutdown until complete Maintain a log of all actions performed, photo the screen, identify OS Check system for use of encryption, dump RAM to sterile storage Complete full report of steps taken and evidence gathered NIST SP 800-88 Guidelines for Media Sanitization Clear, Purge, Destroy Data Acquisition - RAW Advantages Data transferring is fast Can ignore minor data read errors on the source drive A Universal acquisition format that most of the forensic tools can read Data Acquisition - RAW Disadvantages Takes same storage space as that of original disk or data set Some tools like freeware versions may not collect bad sectors on the source drive Data Acquisition - RAW Purpose Creates simple, sequential, flat files of suspect/data set Data Acquisition - Proprietary Advantages Formats can change from one vendor to another based on features Saves space on target drive and allows to compression of image files of a suspect drive Allows splitting an image into smaller segmented files Ensures data integrity by applying data integrity checks on each segment while splitting It can integrate metadata into image file by adding metadata such as date and time of the acquisition, examiner or investigator name, the hash value of the original medium or disk and case details or comments Data Acquisition - Proprietary Disadvantages