NDLI: Workshop: Digital Discovery with Bootable CDs

Please wait, while we are loading the content...

2015 Ninth International Conference on IT Security Incident Management & IT Forensics

2014 Eighth International Conference on IT Security Incident Management & IT Forensics

2013 Seventh International Conference on IT Security Incident Management and IT Forensics

2011 Sixth International Conference on IT Security Incident Management and IT Forensics

2009 Fifth International Conference on IT Security Incident Management and IT Forensics

Table of Contents

Workshop: Digital Discovery with Bootable CDs

Overcast: Forensic Discovery in Cloud Environments

Experiences with the NoAH Honeynet Testbed to Detect new Internet Worms

Botnet Statistical Analysis Tool for Limited Resource Computer Emergency Response Team

Semi-autonomous Link Layer Vulnerability Discovery and Mitigation Dissemination

From the Computer Incident Taxonomy to a Computer Forensic Examination Taxonomy

Fast User Classifying to Establish Forensic Analysis Priorities

The Forensic Image Generator Generator (Forensig2)

Safe-Keeping Digital Evidence with Secure Logging Protocols: State of the Art and Challenges

Technique to Interrogate an Image of RAM

An Automated User Transparent Approach to log Web URLs for Forensic Analysis

Self-Forensics Through Case Studies of Small-to-Medium Software Systems

Analysis of Download Accelerator Plus (DAP) for Forensic Artefacts

A Comprehensive and Comparative Analysis of the Patching Behavior of Open Source and Closed Source Software Vendors

Publisher's Information

Workshop: Digital Discovery with Bootable CDs

Content Provider	IEEE Xplore Digital Library
Author	Moll, R. Prokop, M. Morgenstern, H.
Copyright Year	2009
Abstract	Boot-CDs are a flexible and powerful method to assist in the whole forensic process from live examination to acquisition, searching and recovery. Linux was ever since the most popular OS for this purpose, but in some cases windows-based Live-CDs are also useful. In this workshop we present different real-life case scenarios and the corresponding live-boot-solution. Since kernel 2.6 Linux is able to create forensically sound images even of partitions/harddisks with odd sectors. But one has to be aware of a lot of other circumstances which can alter the evidence: mounting filesystems, automatic activation of software RAID arrays, using LVMs or swap-space on the target disk. A lot of Linux-Boot-CDs seem to take care of all the critical points, but in fact there are only few well documented tests available. Another problem of the ready-to-download Linux Live-CD images is the lack of support for brand new hardware. So a framework to build a custom linux-live-system with current kernel versions and packages would be really helpful. We will present grml, a Debian based live system, developed by the Austrian Debian Developer Michael Prokop and the grml team. This system satisfies all the above mentioned initial conditions and much more. Various boot parameters allow to control the behavior of the live system, e.g. the parameter "forensic", which is a shortcut for "nofstab noraid noautoconfig noswap raid=noautodetect readonly ...". Additionally the grml system can be booted from CD/DVD, USB-/Firewire-Device, Remote-Adapter (iLO, RSA2, ...), Flash-Card and PXE. In this workshop you'll learn how to use grml for forensic investigations and how to build your own live system using the grml-live framework. On some brand-new mainboards the grml system might still fail, because the chipset, especially the onboard-raid-chipset is not yet supported by the linux kernel. For these cases a forensically sound windows-based boot-CD as plan B is needed. So the workshop will present a way to build a forensically sound windows based boot CD using the standard Windows Automated Installation Kit for Windows Vista along with some registry modifications.
File Size	122161
File Format	PDF
ISBN	9780769538075
DOI	10.1109/IMF.2009.20
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2009-09-15
Publisher Place	Germany
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Conferences Forensics Linux Firewire Digital discovery Hardware Boot-CD Kernel Acquisition Live examination Forensic images
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in