In this chapter, we will discuss the acquisition of Hard Disk Drives or HDD. Data acquisition is critical because performing analysis on the original hard drive may cause failure on the only hard drive that contains the data or you may write to that original hard drive by mistake.
So, creating a forensics image from the hard drive must be performed prior to the analysis. The acquisition of the HDD can be either conducted at the incident scene or in the analysis lab, on a live or a powered off system, and over network or locally, as we will see in this chapter.
In a nutshell, we will cover the following topics:
Forensic image
Incident response CDs
Live imaging of a hard drive
Linux for the imaging of a hard drive
Virtualization in data acquisition
Evidence integrity
Disk wiping in Linux