Difference between pages "Category:Disk imaging" and "Cloud Forensics Bibliography"

From Forensics Wiki
(Difference between pages)
Jump to: navigation, search
m (Hardware imagers)
 
 
Line 1: Line 1:
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#dddddd; align:center;">
+
'''In chronological order, oldest to most recent'''
'''Note:''' We're trying to use the same [[tool template]] for all devices. Please use this if possible.
+
</div>
+
  
'''TODO: Not all of the following are tools, most are simply company names. The tools should have their own articles...'''
+
<bibtex>
 +
@article{Dykstra12,
 +
author = "Josiah Dykstra and Alan T. Sherman",
 +
title = "Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques",
 +
journal = "Digital Investigation",
 +
volume = {9},
 +
year = {2012},
 +
pages = {S90--S98},
 +
  url="http://ww.cs.umbc.edu/~dykstra/DFRWS_Dykstra.pdf"
 +
</bibtex>
  
= Hardware imagers =
+
<bibtex>
; [[DFL-DE Data Recovery Tool]]
+
@inproceedings{ISSA,
: Including three main modules: disk imaging modules, file recovery modules and automatic hdd repair modules, fixing both detected and undetected hard drives. http://www.datarecoverytools4u.com/product/data-extractor-dfl-de/.
+
author = "Waldo Delport and Michael Kohn and Martin S. Olivier",
;[[Data Compass]]
+
  title = "Isolating a cloud instance for a digital forensic investigation",
:A hardware and software tool by [[SalvationDATA]] that can image data from bad sectors, unstable heads and other drives.
+
  booktitle={Proceedings of the 2011 Information Security for South Africa (ISSA 2011) Conference},
; [[DeepSpar Disk Imager]]
+
  year={August 2011},
: Handles Data Recovery Imaging issues, drive instability, and bad sectors. http://www.deepspar.com/products-ds-disk-imager.html - Data Sheet and Whitepaper available for download from product web page.
+
  organization={ISSA},
; [[ICS Solo3]]
+
</bibtex>
: Supports USB, Firewire and SCSI drives. http://www.icsforensic.com/
+
; [[Logicube Talon]]
+
: Supports USB
+
; [[PSIClone]]
+
: Built-in PATA, SATA, USB and write blocker. http://www.thepsiclone.com/
+
: Enhanced Error Handling and Logging
+
; [[Voom HardCopy III]]
+
: Allows destination drive to be formatted in NTFS.
+
  
= Unix-based imagers=
+
<bibtex>
 +
@article{CLSR,
 +
author = "Esther George and Stephen Mason",
 +
title = "Digital evidence and ‘cloud’ computing",
 +
journal = "Computer Law & Security Review",
 +
volume = {27},
 +
issue = {5},
 +
year = {September 2011},
 +
pages = {524--528}
 +
</bibtex>
  
; '''ewfacquire''', '''ewfacquirestream'''
+
<bibtex>
: The tools '''ewfacquire''' and '''ewfacquiresteam''' are part of the [[libewf]] library package. They can create evidence files in the [[EnCase]] and [[FTK Imager]] .E0* (EWF-E01) and [[SMART]] .s0* (EWF-S01) formats. '''ewfacquire''' is intended to read from devices and '''ewfacquirestream''' from pipes. Both tools calculate an [[MD5]] hash on default while the data is being acquired. They are able to calculate a [[SHA1]] message digest as well, but because of compatibility with [[EnCase]] they only store the [[SHA1]] hash in the Extended EWF (EWF-X) format. '''ewfacquire''' and '''ewfacquirestream''' provide support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.
+
@article{dykstraJournal,
: http://code.google.com/p/libewf/
+
  author = "Josiah Dykstra and Alan. T. Sherman",
 +
  title = "Understanding Issues in Cloud Forensics: Two Hypothetical Case Studies",
 +
  journal ={Journal of Network Forensics},
 +
  volume = {3},
 +
  number = {1},
 +
  year = {Autumn, 2011},
 +
  pages = {19--31}
 +
}
 +
</bibtex>
  
; [[Adepto]]
+
<bibtex>
: http://www.e-fense.com/helix/
+
@article{ruan,
 +
  title="Cloud forensics: An overview",
 +
  author={Keyun Ruan and Joe Carthy and Tahar Kechadi and Mark Crosbie},
 +
  booktitle={Advances in Digital Forensics VII},
 +
  year={2011},
 +
  url="http://cloudforensicsresearch.org/publication/Cloud_Forensics_An_Overview_7th_IFIP.pdf"
 +
}
  
; [[aimage]]
+
</bibtex>
: Part of the [[AFF]] system, [[aimage]] can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. [[aimage]]  can optionally compress and calculate [[MD5]] or [[SHA-1]] hash residues while the data is being copied. It has intelligent error recovery, similar to what is in [[ddrescue]].
+
<bibtex>
  
; [[AIR]]
+
@inproceedings{ruanSurvey,
: AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
+
  title="Survey on cloud forensics and critical criteria for cloud forensic capability: A preliminary analysis",
: http://air-imager.sourceforge.net/
+
  author={Keyun Ruan and Ibrahim Baggili and Joe Carthy and Tahar Kechadi},
 +
  booktitle={Proceedings of the 2011 ADFSL Conference on Digital Forensics, Security and Law},
 +
  year={2011},
 +
  organization={ADFSL},
 +
  url="http://www.cloudforensicsresearch.org/publication/Survey_on_Cloud_Forensics_and_Critical_Criteria_for_Cloud_Forensic_Capability_6th_ADFSL.pdf"
 +
}
 +
</bibtex>
  
; [[dcfldd]]
+
<bibtex>
: A version of [[dd]] created by the [[Digital Computer Forensics Laboratory]]. [[dcfldd]] is an enhanced version of [[GNU]] dd with features useful for forensics and security, such as calculating [[MD5]] or [[SHA-1]] [[hash]]es on the fly and faster disk wiping.
+
@article{CloudForensics,
 +
  author = {Mark Taylor and John Haggerty and David Gresty and David Lamb},
 +
  title = {Forensic investigation of cloud computing systems},
 +
  journal ={Network Security},
 +
  volume = {2011},
 +
  number = {3},
 +
  year = {2011},
 +
  pages = {4--10},
 +
  url="http://www.whieb.com/download.jsp?address=/upload%2Fdoc%2F20110415%2Fforensic+investigation+of+cloud+computing+systems.pdf"
 +
}
  
; [[dd]]
+
</bibtex>
: A program that converts and copies files, is one of the oldest [[Unix]] programs. I can copy data from any Unix "file" (including a [[raw partition]]) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces [[raw image files]]. Extended into [[dcfldd]].
+
<bibtex>
  
; EnCase [[LinEn]]
+
@inproceedings{birk,
: Linux-based version of EnCase's forensic imaging tool.
+
  title="Technical Issues of Forensic Investigations in Cloud Computing Environments",
 +
  booktitle = {Proceedings of the 6th International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE)},
 +
  author={Dominik Birk and Christoph Wegener},
 +
  year={2011},
 +
  organization={IEEE},
 +
  address = {Oakland, CA, USA},
 +
  url="http://code-foundation.de/stuff/2011-birk-cloud-forensics.pdf"
 +
}
  
; GNU [[ddrescue]]
+
</bibtex>
: http://www.gnu.org/software/ddrescue/ddrescue.html
+
  
; [[dd_rescue]]
+
<bibtex>
: http://www.garloff.de/kurt/linux/ddrescue/
+
@article{Araiza11,
: A tool similar to [[dd]], but unlike dd it will continue reading the next sector, if it stumbles over bad sectors it cannot read.
+
  title="Electronic Discovery in the Cloud",
 +
  author={Alberto G. Araiza},
 +
  journal={Duke Law and Technology Review},
 +
  volume = {8},
 +
  year = {2011},
 +
  url="http://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=1222&context=dltr"
 +
}
 +
</bibtex>
  
; iLook [[IXimager]]
+
<bibtex>
: The primary imaging tool for [[iLook]]. It is [[Linux]] based and produces compressed authenticatable [[image file]]s that may only be read in the iLook analysis tool.
+
@article{Cross10,
 +
  title="E-Discovery and Cloud Computing: Control of ESI in the Cloud",
 +
  author={David D. Cross and Emily Kuwahara},
 +
  journal={EDDE Journal},
 +
  volume = {1},
 +
  number = {2},
 +
  year = {2010},
 +
  pages = {2--12},
 +
  url="http://www.crowell.com/documents/E-Discovery-and-Cloud-Computing-Control-of-ESI-in-the-Cloud.pdf"
 +
}
 +
</bibtex>
  
; [[MacQuisition Boot CD]]
+
<bibtex>
: Provides software to safely image [[Macintosh]] drives.
+
@book{Lil10,
 +
  title="Digital Forensics for Network, Internet and Cloud Computing: A Forensic Evidence Guide for Moving Targets and Data",
 +
  author={Terrance V. Lillard},
 +
  year={2010},
 +
  publisher={Syngress},
 +
}
 +
</bibtex>
  
; [[rdd]]
+
<bibtex>
: http://sourceforge.net/projects/rdd
+
@inproceedings{Lu10,
: Rdd is robust with respect to read errors and incorporates several other functions: MD5 and SHA-1 hashing, block hashing, entropy computation, checksumming, network transfer, and output splitting.
+
  title="Secure provenance: the essential of bread and butter of data forensics in cloud computing",
 +
  booktitle={Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security (ASIACCS '10)},
 +
  author={Rongxing Lu and Xiaodong Lin and Xiaohui Liang and Xuemin Sherman Shen},
 +
  pages={282--292},
 +
  year={2010},
 +
  address={New York, NY, USA},
 +
  organization={ACM},
 +
  url="http://bbcr.uwaterloo.ca/~rxlu/paper/asiaccs185-lu.pdf"
 +
}
  
; [[sdd]]
+
</bibtex>
: Another [[dd]]-like tool. It is supposed to be faster in certain situations.
+
  
= Windows-based imagers =
+
<bibtex>
  
; [[AccessData]]
+
@inproceedings{Wol09,
: Their ultimate tool lets you "READ, ACQUIRE, DECRYPT, ANALYZE and REPORT (R.A.D.A.R.)."
+
  title="Overcast: Forensic Discovery in Cloud Environments",
 +
  booktitle = {Proceedings of the 2009 Fifth International Conference on IT Security Incident Management and IT Forensics (IMF '09)},
 +
  author={Stephen D. Wolthusen},
 +
  pages={3--9},
 +
  year={2009},
 +
  address={Washington, DC, USA},
 +
  organization={IEEE Computer Society}
 +
}
  
; [[ASR]]
+
</bibtex>
: A tool for [[imaging]] and analyzing disks.
+
  
; [[DIBS]]
 
: Can image and convert many file formats. Also builds mobile toolkit.
 
  
; [[EnCase]]
 
: Can image with out dongle plugged in. Only images to E0* file.
 
  
; [[FTK Imager]] by [[AccessData]]
+
[[Category:Bibliographies]]
: Can image and convert many image formats. Including [[E0*]] (EWF-E01), s0* (EWF-S01) and [[dd]]. Also a free tool.
+
 
+
; [[Ghost]]
+
: FTK can read forensic, uncompressed [[Ghost image]]s.
+
 
+
; [[iLook]]
+
: The [[IRS]]'s set of forensic tools and utilities.  iLook V8 can image in Windows.
+
 
+
; [[Paraben]]
+
: A complete set of tools for [[Windows]] (and [[handheld]]) products.
+
 
+
; [[ProDiscovery]]
+
: Images and searches [[FAT12]], [[FAT16]], [[FAT32]] and all [[NTFS]] files.
+
 
+
; [[X-Ways Forensics]]
+
: Has some limited imaging capabilities. The output is [[raw format]].
+
 
+
; [[X-Ways Replica]]
+
: Performs [[hard disk]] [[cloning]] and imaging. The output is [[raw format]].
+
 
+
 
+
[[Category:Tools]]
+
 
+
[[Category:Tools]]
+

Revision as of 09:43, 27 June 2012

In chronological order, oldest to most recent

Josiah Dykstra, Alan T. Sherman - Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques
Digital Investigation 9:S90--S98,2012
http://ww.cs.umbc.edu/~dykstra/DFRWS_Dykstra.pdf
Bibtex
Author : Josiah Dykstra, Alan T. Sherman
Title : Acquiring forensic evidence from infrastructure-as-a-service cloud computing: Exploring and evaluating tools, trust, and techniques
In : Digital Investigation -
Address :
Date : 2012

Waldo Delport, Michael Kohn, Martin S. Olivier - Isolating a cloud instance for a digital forensic investigation
Proceedings of the 2011 Information Security for South Africa (ISSA 2011) Conference ,August 2011
Bibtex
Author : Waldo Delport, Michael Kohn, Martin S. Olivier
Title : Isolating a cloud instance for a digital forensic investigation
In : Proceedings of the 2011 Information Security for South Africa (ISSA 2011) Conference -
Address :
Date : August 2011

Esther George, Stephen Mason - Digital evidence and ‘cloud’ computing
Computer Law & Security Review 27:524--528,September 2011
Bibtex
Author : Esther George, Stephen Mason
Title : Digital evidence and ‘cloud’ computing
In : Computer Law & Security Review -
Address :
Date : September 2011

Josiah Dykstra, Alan. T. Sherman - Understanding Issues in Cloud Forensics: Two Hypothetical Case Studies
Journal of Network Forensics 3(1):19--31,Autumn, 2011
Bibtex
Author : Josiah Dykstra, Alan. T. Sherman
Title : Understanding Issues in Cloud Forensics: Two Hypothetical Case Studies
In : Journal of Network Forensics -
Address :
Date : Autumn, 2011

Keyun Ruan, Joe Carthy, Tahar Kechadi, Mark Crosbie - Cloud forensics: An overview
,2011
http://cloudforensicsresearch.org/publication/Cloud_Forensics_An_Overview_7th_IFIP.pdf
Bibtex
Author : Keyun Ruan, Joe Carthy, Tahar Kechadi, Mark Crosbie
Title : Cloud forensics: An overview
In : -
Address :
Date : 2011

Keyun Ruan, Ibrahim Baggili, Joe Carthy, Tahar Kechadi - Survey on cloud forensics and critical criteria for cloud forensic capability: A preliminary analysis
Proceedings of the 2011 ADFSL Conference on Digital Forensics, Security and Law ,2011
http://www.cloudforensicsresearch.org/publication/Survey_on_Cloud_Forensics_and_Critical_Criteria_for_Cloud_Forensic_Capability_6th_ADFSL.pdf
Bibtex
Author : Keyun Ruan, Ibrahim Baggili, Joe Carthy, Tahar Kechadi
Title : Survey on cloud forensics and critical criteria for cloud forensic capability: A preliminary analysis
In : Proceedings of the 2011 ADFSL Conference on Digital Forensics, Security and Law -
Address :
Date : 2011

Mark Taylor, John Haggerty, David Gresty, David Lamb - Forensic investigation of cloud computing systems
Network Security 2011(3):4--10,2011
http://www.whieb.com/download.jsp?address=/upload%2Fdoc%2F20110415%2Fforensic+investigation+of+cloud+computing+systems.pdf
Bibtex
Author : Mark Taylor, John Haggerty, David Gresty, David Lamb
Title : Forensic investigation of cloud computing systems
In : Network Security -
Address :
Date : 2011

Dominik Birk, Christoph Wegener - Technical Issues of Forensic Investigations in Cloud Computing Environments
Proceedings of the 6th International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE) , Oakland, CA, USA,2011
http://code-foundation.de/stuff/2011-birk-cloud-forensics.pdf
Bibtex
Author : Dominik Birk, Christoph Wegener
Title : Technical Issues of Forensic Investigations in Cloud Computing Environments
In : Proceedings of the 6th International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE) -
Address : Oakland, CA, USA
Date : 2011

Alberto G. Araiza - Electronic Discovery in the Cloud
Duke Law and Technology Review 8,2011
http://scholarship.law.duke.edu/cgi/viewcontent.cgi?article=1222&context=dltr
Bibtex
Author : Alberto G. Araiza
Title : Electronic Discovery in the Cloud
In : Duke Law and Technology Review -
Address :
Date : 2011

David D. Cross, Emily Kuwahara - E-Discovery and Cloud Computing: Control of ESI in the Cloud
EDDE Journal 1(2):2--12,2010
http://www.crowell.com/documents/E-Discovery-and-Cloud-Computing-Control-of-ESI-in-the-Cloud.pdf
Bibtex
Author : David D. Cross, Emily Kuwahara
Title : E-Discovery and Cloud Computing: Control of ESI in the Cloud
In : EDDE Journal -
Address :
Date : 2010

Terrance V. Lillard - Digital Forensics for Network, Internet and Cloud Computing: A Forensic Evidence Guide for Moving Targets and Data
Syngress,2010
Bibtex
Author : Terrance V. Lillard
Title : Digital Forensics for Network, Internet and Cloud Computing: A Forensic Evidence Guide for Moving Targets and Data
In : -
Address :
Date : 2010

Rongxing Lu, Xiaodong Lin, Xiaohui Liang, Xuemin Sherman Shen - Secure provenance: the essential of bread and butter of data forensics in cloud computing
Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security (ASIACCS '10) pp. 282--292, New York, NY, USA,2010
http://bbcr.uwaterloo.ca/~rxlu/paper/asiaccs185-lu.pdf
Bibtex
Author : Rongxing Lu, Xiaodong Lin, Xiaohui Liang, Xuemin Sherman Shen
Title : Secure provenance: the essential of bread and butter of data forensics in cloud computing
In : Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security (ASIACCS '10) -
Address : New York, NY, USA
Date : 2010

Stephen D. Wolthusen - Overcast: Forensic Discovery in Cloud Environments
Proceedings of the 2009 Fifth International Conference on IT Security Incident Management and IT Forensics (IMF '09) pp. 3--9, Washington, DC, USA,2009
Bibtex
Author : Stephen D. Wolthusen
Title : Overcast: Forensic Discovery in Cloud Environments
In : Proceedings of the 2009 Fifth International Conference on IT Security Incident Management and IT Forensics (IMF '09) -
Address : Washington, DC, USA
Date : 2009