I often have a need to collect logical files in eDiscovery cases and have for some time been looking for a way to create a container file for logical file captures that allows me to preserve the file meta data of the files and folders; that I am collecting from remote computers that I am connected to using the excellent F-Response tool.
I know that I can create a full physical image of the connected iscsi drive and even copy out files, but I wanted to be able to preserve the metadata and collect only responsive data.
I am aware that both EnCase and FTK gives you the option to create logical evidence files (LEF), but I wanted to do it under Linux. After speaking with Andy Rosen (Thanks Andy); I was able to achieve this using a loopback mounted dd image which created an ext3 filesystem within and then mounted read write to store the logical files in. This can also be achieved using Andy Rosens's SMART tool; sorry you will have to sign up for some SMART training to find out how to do it in SMART!
Another way to use this process is to make the mounted container file available on the network to Windows using SAMBA and send the data across to the SAMBA share.
The end result is a dd image file that contains all our logical files preserved in a read only dd container file that is accessible by any forensic tool that supports the dd raw image format.
In summary the steps are;
1. Connect to our target computer using F-Response and mount the target partiton as /mnt/fres on our Linux box
2. Create a 10GB dd image that is formatted, mounted and accessible read/write as mount point /mnt/evidence
3. Use the Linux cp command to copy the files of interest preserving the file meta data to our mounted dd image.
4. Umount the dd image and create a MD5 hash value of the dd image.
Create 10GB DD image file
sudo dd if=/dev/zero of=evidence.dd bs=10485760 count=1024
Make DD image file accessible to create filesystem
sudo losetup /dev/loop0 evidence.dd
Create Partition within DD Container file
sudo echo -e “n\n p\n 1\n \n \n w\n” | fdisk /dev/loop0
Create File system in DD Container file
sudo mkfs.ext3 /dev/loop0
Detach DD image file from /dev/loop0
sudo losetup –d /dev/loop0
Mount the Container File
sudo mount -o loop,rw evidence.dd /media/evidence
Change directory into mounted DD Container file mount point
cd /media/evidence
Copying Logical files e.g.
sudo cp -vdpR /mnt/fres/data /mnt/evidence
-v Verbose show us whats going on
-d Preserve the links
-p Preserve the specified attributes (default: mode,owner‐ ship,timestamps)
-R Recurse the directories
When we have completed our capture we need to navigate away from the /mnt/evidence directory and umount the mounted image file.
sudo cd..
sudo umount /mnt/evidence
It is probably a good idea to create and MD5 hash value for our image file before we finish up.
sudo md5sum evidence.dd > evidence.dd.MD5
There we have a dd image file of our logical files that is protected from accidential metadata changes, (unless you choose to mount it read write) that can now be accessed by any forensic software that supports dd image format.
No comments:
Post a Comment