5. Storage acquisition and integrity

8. Acquisition

Storage acquisition

In short: acquire once, verify, then work only from the copy.

Once volatile evidence is preserved and the machine is powered down, acquire the storage. Acquisition is copying evidence in a way that can be shown to be complete and faithful.

Image the whole physical device

Take a bit-for-bit image of every sector from the first to the last, including:

• partition tables and unpartitioned space;
• every partition, whether or not it mounts;
• unallocated space within filesystems;
• slack space at the ends of files.

Copying visible files, or imaging only the partition the operating system shows, discards exactly the material a difficult examination depends on: deleted entries, earlier partition layouts, hidden volumes, corrupted metadata.

Hidden areas: where a device has host-protected or device-configuration-overlay areas, record whether the imaging tool reports and includes them.

Block writes

• Use a hardware write blocker. It permits reads and refuses writes whatever the workstation's operating system attempts, and cannot be misconfigured by a distracted operator.
• No hardware option? For an NVMe drive without a suitable bridge, or an embedded device, use a software write-blocking configuration whose behaviour you have validated on a test drive and recorded.
• Test the blocker on a scratch drive before the first real use of the day, and record the test.

Choose an imaging tool

• FTK Imager (Windows): raw or E01 images with built-in hashing and verification and a readable acquisition log.
• Guymager (Linux): raw, E01 or AFF images, hashes as it goes, verifies on completion and writes a detailed information file.
• dc3dd (command line): a forensic extension of dd with hashing, progress and logging, suitable for scripted or headless acquisition.
• Comparable established tools (ewfacquire, Tableau imagers, the acquisition modules of the commercial suites) are equally acceptable.

Handle failing media and bad sectors

A drive that reports read errors, clicks, spins down or stalls is failing, and every read may be its last. Imaging comes before any thought of repair, and repair is never done to the original.

Use a fault-tolerant tool designed for the job, run it once with a strategy that captures the good areas first, and let it manage the retries:

• GNU ddrescue reads the good areas first, then returns to bad areas in later passes with progressively smaller blocks. It keeps a map file recording which sector ranges were read, which failed and which were not attempted.
• The error-tolerant modes of the forensic imagers above serve the same purpose for lightly damaged drives and record unreadable ranges in their logs.

• Keep the map file with the image. It is the only record of which parts of the image are real data and which are zero-filled gaps, and it is required evidence in its own right.
• Record unreadable sector ranges in your notes as well as in the tool's output.
• Flag dependent findings. Any finding that depends on data near an unreadable range must say so.

Never run repair tools against the original

Do not run any of these against evidential media:

• chkdsk, fsck or scandisk;
• the automatic repair an operating system offers on mounting a "dirty" volume;
• a drive manufacturer's repair utility;
• any tool whose purpose is to make a filesystem consistent.

These tools write to the disk. They rebuild directory structures, discard entries they consider invalid, move data they consider orphaned and update journals and bitmaps. Every one of those actions destroys the evidence of what the filesystem looked like before.

Corrupted metadata is itself evidentially significant. Each of these tells a story about what happened and when, and repairing them erases it:

• a partially overwritten directory record;
• a journal entry for a deletion that never completed;
• a partition table describing a layout the drive no longer has;
• a filesystem deliberately damaged to hide files.

Reconstruct from a verified copy (section 18) and leave the original as found.

9. Acquisition, documentation

Integrity verification

In short: hashing, verification, working from copies and secure storage let you say, months later, that the image you analysed is exactly what was on the device on the day.

Hash everything at acquisition

A cryptographic hash turns any amount of data into a short fixed-length value. Change one bit and the hash changes completely.

• Use SHA-256, the current standard. MD5 and SHA-1 are still seen and are acceptable only alongside a stronger hash, never alone.
• Hash the source device before imaging where the tool supports it, and hash the image afterwards.
• Hash every exported file, log and memory capture at the point of acquisition.
• Record the values in your notes and on the evidence form, not only in the tool's output.

Verify every acquisition

• Read back and compare. After imaging, the tool should read the image back and confirm its hash matches the source's. Keep that verification report.
• ddrescue images with unreadable ranges: the source cannot be hashed in full. Hash the image file, keep the map file, and state in the notes that source verification was not possible and why.
• Re-verify on every move. Whenever an image is copied, moved or restored from storage, and before analysis begins.

Preserve the full set

Retain all of these for the life of the case, each with its hash:

• The original evidence, sealed after imaging and not touched again except under observation.
• The forensic master image, verified once and never opened for analysis.
• The validated working copies used for analysis, each verified against the master before use.
• The acquisition logs and verification reports from every tool.
• The hash values, recorded independently of the tool output.
• Error information: every read error, warning and failed attempt.
• Unreadable sector ranges and map files where applicable.
• Memory captures and their acquisition records.

Work from copies, never the original

• All analysis happens on a working copy of the verified image.
• Working copy damaged? Make another from the master.
• Master questioned? The original can be re-imaged under observation.
• Mount images read-only, and confirm it. A mounted image whose hash changes afterwards is a working copy that has been altered, and its findings are open to challenge.

Store evidence securely

• Physical evidence goes in tamper-evident bags with the seal number recorded, in a locked cabinet or room with restricted, logged access.
• Image files go on encrypted storage with access limited to the examination team and every access logged. Keep at least two copies in separate locations.
• Protect against the environment: heat, magnets, damp and static for drives; battery discharge for phones.
• Set the retention period with legal counsel and record it. Evidence destroyed early cannot be re-examined; evidence kept forever is a data protection liability.