Workshop: Digital Discovery with Bootable CDs

• Published in: 2009 Fifth International Conference on IT Security Incident Management and IT Forensics p. x
• Main Authors: Moll, R., Prokop, M., Morgenstern, H.
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01-09-2009
• Subjects: acquisition; Boot-CD; Conferences; digital discovery; Firewire; forensic images; Forensics; Hardware; Kernel; Linux; live examination
• ISBN: 076953807X; 9780769538075
• DOI: 10.1109/IMF.2009.20

Boot-CDs are a flexible and powerful method to assist in the whole forensic process from live examination to acquisition, searching and recovery. Linux was ever since the most popular OS for this purpose, but in some cases Windows-based live-CDs are also useful. In this workshop we present different real-life case scenarios and the corresponding live-boot-solution. Since kernel 2.6 Linux is able to create forensically sound images even of partitions/harddisks with odd sectors. But one has to be aware of a lot of other circumstances which can alter the evidence: mounting filesystems, automatic activation of software RAID arrays, using LVMs or swap-space on the target disk. A lot of Linux-boot-CDs seem to take care of all the critical points, but in fact there are only few well documented tests available. Another problem of the ready-to-download Linux live-CD images is the lack of support for brand new hardware. So a framework to build a custom Linux-live-system with current kernel versions and packages would be really helpful. We present grml, a Debian based live system, developed by the Austrian Debian developer Michael Prokop and the grml team. This system satisfies all the above mentioned initial conditions and much more. Various boot parameters allow to control the behavior of the live system, e.g. the parameter "forensic", which is a shortcut for "nofstab noraid noautoconfig noswap raid=noautodetect readonly ...". Additionally the grml system can be booted from CD/DVD, USB-/firewire-device, remote-adapter (iLO, RSA2, ...), flash-card and PXE. In this workshop you'll learn how to use grml for forensic investigations and how to build your own live system using the grml-live framework. On some brand-new mainboards the grml system might still fail, because the chipset, especially the onboard-raid-chipset is not yet supported by the Linux kernel. For these cases a forensically sound windows-based boot-CD as plan B is needed. So the workshop present a way to build a forensically sound windows based boot CD using the standard Windows automated installation kit for Windows Vista along with some registry modifications.