Chapter4DataAcquisition分析.pptVIP

* Summary (continued) Always validate acquisition A Linux Live CD, such as Helix, provides many useful tools for computer forensics acquisitions Preferred Linux acquisition tool is dcfldd (not dd) Use a physical write-blocker device for acquisitions To acquire RAID disks, determine the type of RAID And then which acquisition tool to use * Capturing an Image with AccessData FTK Imager (continued) * Validating Data Acquisitions Most critical aspect of computer forensics Requires using a hashing algorithm utility Validation techniques CRC-32, MD5, and SHA-1 to SHA-512 * Linux Validation Methods