Web  site
Skip Navigation Links
Home
About C-DAC
Research
Products
Training
Themes:
.:: Members Area ::.
 
 
    
Forgot Password ? Sign Up

.:: Visitor No. ::.
14962

Disk Forensics
Disk forensics is the science of extracting forensic information from digital storage media like Hard disk, USB devices, Firewire devices, CD, DVD, Flash drives, Floppy disks etc.. The process of Disk Forensics are
  1. Identify digital evidences
  2. Acquire the evidence
  3. Authenticate the evidence
  4. Preserve the evidence
  5. Analyze the evidence
  6. Report the findings

Identify digital storage devices
First step in Disk Forensics is the identification of the storage devices in the crime scene. Computers may having the disks like Hard disk of IDE/SCSI, CD, DVD, Floppy disk etc, Mobiles, PDAs etc may having the flash card, SIM, USB/ Firewire disks, Magnetic Tapes, Zip drives, Jazz drives etc.

Acquire the Storage devices
Once the digital evidences are identified, it should be acquired by any of the forensic imaging tool. Acquisition is a process of bit-stream imaging. Imaging should be done with correct and complete data and also it should maintain the Disk Geometry. During this process the source media should be write protected.

Authenticate the evidence
Once the imaging has done, it should be verified with the original one. Hashing is a mechanism to prove that the copy is exact with original and it has not been altered.

Preserve the evidence
Electronic evidences might be altered or tampered without trace. Once the acquisition and authentication has done, the original evidence should be placed in secure storage. One more copy of image should be taken and it needs to be stored into appropriate media or reliable mass storage. Optical media can be use as the mass storage. It is reliable, fast, longer life span and reusable.

Analyze the evidence
Analysis is a searching of relevant information in the digital evidence. Analysis should be in the complete evidence without leaving a single bit of information. Searching may be of files or data in normal files and folders, Registries, Pictures, databases, cookies, temporary files, swap, Internet History, passwords etc and ambient data area like deleted, formatted, slack, unallocated, lost

Report the findings
Report generation is an important and the final stage in Disk Forensics. The value of the evidence will ultimately depend on the way it is presented. Technical evidence of the report should be in simple and precise way so that the non – technical person can also understand.