Cyber Crime and Cyber Terrorism

78
CHAPTER 7
Seizing, imaging, and analyzing digital evidence
(
Anson, et al. 2012
). The tools selected should also leave as small a footprint as 
possible, and operate in read only mode. Most RAM acquisition tools are portable, 
usually taking the form or a USB device and require no installation, again, to limit 
the footprint. Once the memory dump has been taken the computer should be shut 
down using the methods previously discussed.
IMAGE
It is essential that the process of forensically analyzing the media does not intro-
duce any contaminants from the investigator. Interacting with storage media without 
appropriate precautions will cause data to be written to the media and potentially 
invalidate the evidence. In order to reduce the likelihood of this happening foren-
sic analysis should not be performed on the actual media storage device seized but 
should instead be performed on an image, that is a sector-by-sector replica of the me-
dia. There are many software tools to allow an image to be acquired from the media, 
and it is not within the scope of this work to discuss them individually. However, it 
is recommend that the selected tool should boot from a live CD/DVD and that the 
evidence is mounted by the tool in “read only” mode to reduce the likelihood of ac-
cidently writing to it. Further re-assurance that the evidence has not been contami-
nated can be provided through the use of write blockers. Write blockers are devices 
which are placed in line between the system being used to analyze the media and 
the media storage device itself. They allow read commands to be passed through 
to the media storage device, but block write commands. Write blockers are readily 
available and allow for the attachment to and from a variety of different interfaces, 
e.g., USB, Firewire, SCSI, and SATA controllers. Finally when an image has been 
acquired it should be verified as an exact copy by comparing the hash values of the 
two images. Hash values are a fixed sized bit string created by passing data through a 
cryptographic hash function. Any modification of the evidence, however small, will 
change its hash value. If the hash files of the acquired image and that of the media 
being investigated are different then either the image is invalid, or the evidence itself 
has been compromised.