Disk Imaging - Revision history

Joachim Metz: /* External Links */

2012-09-19T18:27:28Z

‎External Links

2012-09-19T18:22:58Z

‎External Links

2012-09-19T18:21:01Z

‎External Links

2012-09-06T18:20:52Z

‎Also see

2012-07-28T09:29:59Z

‎Decryption while imaging

2012-07-28T09:28:58Z

‎Integrity

2012-07-28T09:27:19Z

‎Integrity

2012-07-28T09:25:52Z

‎Error tolerance and recovery

2012-07-28T06:05:45Z

‎Also see

2012-07-28T06:05:21Z

@@ Line 62: / Line 62: @@
 == External Links ==
 * [http://www.tableau.com/pdf/en/Tableau_Forensic_Disk_Perf.pdf Benchmarking Hard Disk Duplication Performance in Forensic Applications], by [[Robert Botchek]]
-* [http://c-skills.blogspot.ch/2012/06/optimizing-dd.html c-skills: optimizing dd], by Sebastian, June 2012
+* [http://stealth.openwall.net/papers/odd.pdf Feeling odd - Using new OS and CPU features to speed up large file copying], by [[Sebastian Krahmer]], June 2012
 === Hash based imaging ===

@@ Line 62: / Line 62: @@
 == External Links ==
 * [http://www.tableau.com/pdf/en/Tableau_Forensic_Disk_Perf.pdf Benchmarking Hard Disk Duplication Performance in Forensic Applications], by [[Robert Botchek]]
-* [http://c-skills.blogspot.ch/2012/06/optimizing-dd.html c-skills: optimizing dd]
+* [http://c-skills.blogspot.ch/2012/06/optimizing-dd.html c-skills: optimizing dd], by Sebastian, June 2012
 === Hash based imaging ===

@@ Line 62: / Line 62: @@
 == External Links ==
 * [http://www.tableau.com/pdf/en/Tableau_Forensic_Disk_Perf.pdf Benchmarking Hard Disk Duplication Performance in Forensic Applications], by [[Robert Botchek]]
 === Hash based imaging ===

@@ Line 58: / Line 58: @@
 * [[Piecewise hashing]]
 * [[Memory Imaging]]
 == External Links ==

@@ Line 51: / Line 51: @@
 === Decryption while imaging ===
-Encrypted data is worst-case scenario for compression. Because the encryption process should be deterministic a solution to reduce the size of an encrypted image is to store it non-encrypted and compressed and encrypt it on-the-fly if required. Although this should be rare since the non-encrypted data is what undergoes analysis.
+Encrypted data is worst-case scenario for compression. Because the encryption process should be deterministic, a solution to reduce the size of an encrypted image is to store it non-encrypted and compressed and encrypt it again on-the-fly if required. Although this should be rare since the non-encrypted data is what undergoes analysis.
 == Also see ==

@@ Line 20: / Line 20: @@
-By recalculating the integrity hash at a later time, one can determine if the data in the disk image has been changed. This is by no means protection against intentional tampering, but can indicate data corruption.
+By recalculating the integrity hash at a later time, one can determine if the data in the disk image has been changed. This by itself provides no protection against intentional tampering, but can indicate that the data was altered, e.g. due to corruption. The integrity hash does not indicate where int he data the alteration has occurred. Therefore some image tools and/or formats provide for additional integrity checks like:
-The integrity hash does not indicate where the alteration has occurred. Some image tools and/or formats provide for additional integrity checks like:
 * A checksum
 * Parity data

@@ Line 16: / Line 16: @@
 Also see: [[DCO and HPA|Device Configuration Overlay (DCO) and Host Protected Area (HPA)]]
-== Error tolerance and recovery ==
+== Integrity ==
-...
+Often when creating a disk image a [http://en.wikipedia.org/wiki/Cryptographic_hash_function cryptographic hash] is calculated of the entire disk. Commonly used cryptographic hashes are MD5, SHA1 and/or SHA256.
-Also see: [[Piecewise hashing]]
 == Smart imaging ==

@@ Line 5: / Line 5: @@
 The most straight-forward disk imaging method is reading a disk from start to end and writing the data to a [[:Category:Forensics_File_Formats|Forensics image format]].
 This can be a time consuming process especially for disks with a large capacity.
 == Disk Imaging Solutions ==