How To Ship Drives - Revision history

Joachim Metz at 10:57, 27 July 2012

2012-07-27T10:57:25Z

Jbgross at 01:34, 24 February 2010

2010-02-24T01:34:45Z

Jbgross at 01:49, 23 February 2010

2010-02-23T01:49:59Z

Jbgross at 01:48, 23 February 2010

2010-02-23T01:48:19Z

Jbgross at 01:39, 23 February 2010

2010-02-23T01:39:24Z

Jbgross at 01:19, 23 February 2010

2010-02-23T01:19:13Z

Jbgross at 01:08, 23 February 2010

2010-02-23T01:08:40Z

Jbgross: Created page with 'I was recently asked about shipping drives for forensic analysis, and since I've seen this done successfully and seen failures, I thought I would write this advice up for general…'

2010-02-23T01:08:04Z

Created page with 'I was recently asked about shipping drives for forensic analysis, and since I've seen this done successfully and seen failures, I thought I would write this advice up for general…'

New page

I was recently asked about shipping drives for forensic analysis, and since I've seen this done successfully and seen failures, I thought I would write this advice up for general consumption.

Shipping disks is tricky, but often needs to be done. Copying entire images over networks is often impossible due to the sheer size of the image. If you must ship disks, here are some instructions:

# Never ship the original drive (unless necessary for legal reasons). Regardless of the ultimate disposition of the original drive, always start by shipping an [[Category:Disk_Imaging | image]].

# Use one of the [[Write Blockers]] mentioned on this page.

# A drive can be imaged by a number of free software tools, such as [[FTK_Imager]].

# Image to a bare (internal) hard drive, such as [http://www.google.com/products?q=1tb+internal+hard+drive&aq=0&oq=1tb+inter these internal hard drives].

# Use enter a [http://eshop.macsales.com/item/Newer%20Technology/FWU2ES2HDK/]

@@ Line 5: / Line 5: @@
 # Never ship the original drive (unless necessary for legal reasons). Regardless of the ultimate disposition of the original drive, always start by shipping an [[Category:Disk_Imaging | image]].
 # Use one of the [[Write Blockers]] mentioned on this page. The write blocker goes on the original drive to ensure that nothing is changed on the drive by the host OS of the imaging workstation.
-# A drive can be imaged by a number of free software tools, such as [[FTK Imager]]. Some of these tools compress and/or encrypt data; I recommend both, as you don't want someone getting their hands on your data, and if you have multiple images to send, you can put them on one, say, 1TB drive.
+# A drive can be imaged by a number of free software [[:Category:Disk Imaging|tools]], such as [[FTK Imager]]. Some of these tools compress and/or encrypt data; I recommend both, as you don't want someone getting their hands on your data, and if you have multiple images to send, you can put them on one, say, 1TB drive.
 # Image to a bare (internal) hard drive, such as [http://www.google.com/products?q=1tb+internal+hard+drive&aq=0&oq=1tb+inter these internal hard drives].
 # To write to the image drive use either a [http://eshop.macsales.com/item/Newer%20Technology/FWU2ES2HDK/ Firewire/USB2/eSATA docks] or [http://eshop.macsales.com/item/Newer%20Technology/U2ES2HDK/ USB2/eSATA docks]. I recommend getting two of these.

@@ Line 10: / Line 10: @@
 # Keep the original drive safe and intact (and unshipped) until you verify that the image has been received intact.
 # In addition, keep a copy of the images, if possible. This will double your image storage needs, but if you are doing this regularly, you don't want to have to re-image the drives, and I guarantee that failures will occur if you do this long enough. Also, you may have concerns about this original drive, as it may fail.
-# ALWAYS ALWAYS ALWAYS SHIP PROPERLY! Don't ship a drive in an enclosure, as these provide minimal protection, and the drive interface is plugged into something that can move. Not a good idea. Take the drives out of the enclosure (if there is one - if you've followed my advice above, you're working with images on bare drives). Then get either a [http://www.aquaphoenix.com/misc/sale/hdd_box/ hard drive shipping kit], if you are shipping multiple drives, or a [http://www.amazon.com/Hard-Drive-Transporter/dp/B002IY6B9U single drive case]. If you can't do this, wrap the drive in foam sheeting or bubble wrap (three times is good), and tape up the wrapped drive. If you don't have access to any normal packing material, then use towels or other thick cloth. The key is something to absorb impact when the package is inevitably dropped.
+# ALWAYS ALWAYS ALWAYS SHIP PROPERLY! Don't ship a drive in an enclosure, as these provide minimal protection, and the drive interface is plugged into something that can move. Not a good idea. Take the drives out of the enclosure (if there is one - if you've followed my advice above, you're working with images on bare drives). Then get either a [http://www.aquaphoenix.com/misc/sale/hdd_box/ hard drive shipping kit], if you are shipping multiple drives, or a [http://www.amazon.com/Hard-Drive-Transporter/dp/B002IY6B9U single drive case]. If you can't do this, wrap the drive in foam sheeting or bubble wrap (three times is good), and tape up the wrapped drive. If you don't have access to any other packing material, then use towels or other thick cloth. The key is something to absorb impact when the package is inevitably dropped.
 # Make sure you properly unmount the drive from the imaging station before you disconnect it. If you don't know how
 #* [http://macs.about.com/od/faq1/f/ejectcddvd.htm Ejecting Media on a Mac]

@@ Line 4: / Line 4: @@
 # Never ship the original drive (unless necessary for legal reasons). Regardless of the ultimate disposition of the original drive, always start by shipping an [[Category:Disk_Imaging | image]].
 # Use one of the [[Write Blockers]] mentioned on this page. The write blocker goes on the original drive to ensure that nothing is changed on the drive by the host OS of the imaging workstation.
 # A drive can be imaged by a number of free software tools, such as [[FTK Imager]]. Some of these tools compress and/or encrypt data; I recommend both, as you don't want someone getting their hands on your data, and if you have multiple images to send, you can put them on one, say, 1TB drive.
 # Image to a bare (internal) hard drive, such as [http://www.google.com/products?q=1tb+internal+hard+drive&aq=0&oq=1tb+inter these internal hard drives].
 # To write to the image drive use either a [http://eshop.macsales.com/item/Newer%20Technology/FWU2ES2HDK/ Firewire/USB2/eSATA docks] or [http://eshop.macsales.com/item/Newer%20Technology/U2ES2HDK/ USB2/eSATA docks]. I recommend getting two of these.
 # Keep the original drive safe and intact (and unshipped) until you verify that the image has been received intact.
 # In addition, keep a copy of the images, if possible. This will double your image storage needs, but if you are doing this regularly, you don't want to have to re-image the drives, and I guarantee that failures will occur if you do this long enough. Also, you may have concerns about this original drive, as it may fail.
 # ALWAYS ALWAYS ALWAYS SHIP PROPERLY! Don't ship a drive in an enclosure, as these provide minimal protection, and the drive interface is plugged into something that can move. Not a good idea. Take the drives out of the enclosure (if there is one - if you've followed my advice above, you're working with images on bare drives). Then get either a [http://www.aquaphoenix.com/misc/sale/hdd_box/ hard drive shipping kit], if you are shipping multiple drives, or a [http://www.amazon.com/Hard-Drive-Transporter/dp/B002IY6B9U single drive case]. If you can't do this, wrap the drive in foam sheeting or bubble wrap (three times is good), and tape up the wrapped drive. If you don't have access to any normal packing material, then use towels or other thick cloth. The key is something to absorb impact when the package is inevitably dropped.
 # Make sure you properly unmount the drive from the imaging station before you disconnect it. If you don't know how
 #* [http://macs.about.com/od/faq1/f/ejectcddvd.htm Ejecting Media on a Mac]
 #* [http://ask-leo.com/safely_remove_hardware_where_did_the_icon_go_how_do_i_safely_remove_hardware_without_it.html Ejecting Media on Windows]
 #* [http://www.scottklarr.com/topic/133/how-to-mount-and-unmount-a-drive-in-linux/ Ejecting Media on Linux]
 NB: This does NOT take account of chain-of-evidence issues, obviously. This is about imaging and packing ONLY.
 [[Category:Howtos]]

@@ Line 13: / Line 13: @@
 # To write to the image drive use either a [http://eshop.macsales.com/item/Newer%20Technology/FWU2ES2HDK/ Firewire/USB2/eSATA docks] or [http://eshop.macsales.com/item/Newer%20Technology/U2ES2HDK/ USB2/eSATA docks]. I recommend getting two of these.
-# Keep the original drive safe and intact (and unshipped) until you verify that the
+# Keep the original drive safe and intact (and unshipped) until you verify that the image has been received intact.
 # In addition, keep a copy of the images, if possible. This will double your image storage needs, but if you are doing this regularly, you don't want to have to re-image the drives, and I guarantee that failures will occur if you do this long enough. Also, you may have concerns about this original drive, as it may fail.
-# ALWAYS ALWAYS ALWAYS SHIP PROPERLY! Don't ship a drive in an enclosure, as these provide minimal protection, and the drive interface is plugged into something that can move. Not a good idea. Take the drives out of the enclosure (if there is one - if you've followed my advice above, you're working with images on bare drives). Then get either a [http://www.aquaphoenix.com/misc/sale/hdd_box/ hard drive shipping kit], if you are shipping multiple drives, or a [http://www.amazon.com/Hard-Drive-Transporter/dp/B002IY6B9U single drive case]. If you can't do this, wrap the drive in foam sheeting or bubble wrap (three times is good), and tape up the wra
+# ALWAYS ALWAYS ALWAYS SHIP PROPERLY! Don't ship a drive in an enclosure, as these provide minimal protection, and the drive interface is plugged into something that can move. Not a good idea. Take the drives out of the enclosure (if there is one - if you've followed my advice above, you're working with images on bare drives). Then get either a [http://www.aquaphoenix.com/misc/sale/hdd_box/ hard drive shipping kit], if you are shipping multiple drives, or a [http://www.amazon.com/Hard-Drive-Transporter/dp/B002IY6B9U single drive case]. If you can't do this, wrap the drive in foam sheeting or bubble wrap (three times is good), and tape up the wrapped drive. If you don't have access to any normal packing material, then use towels or other thick cloth. The key is something to absorb impact when the package is inevitably dropped.
 [[Category:Howtos]]

@@ Line 17: / Line 17: @@
 # In addition, keep a copy of the images, if possible. This will double your image storage needs, but if you are doing this regularly, you don't want to have to re-image the drives, and I guarantee that failures will occur if you do this long enough. Also, you may have concerns about this original drive, as it may fail.
-# ALWAYS ALWAYS ALWAYS SHIP PROPERLY! Don't ship a drive in an enclosure, as these provide minimal protection, and the drive interface is plugged into something that can move. Not a good idea. Take the drives out of the enclosure (if there is one - if you've followed my advice above, you're working with images on bare drives). Then get
+# ALWAYS ALWAYS ALWAYS SHIP PROPERLY! Don't ship a drive in an enclosure, as these provide minimal protection, and the drive interface is plugged into something that can move. Not a good idea. Take the drives out of the enclosure (if there is one - if you've followed my advice above, you're working with images on bare drives). Then get either a [http://www.aquaphoenix.com/misc/sale/hdd_box/ hard drive shipping kit], if you are shipping multiple drives, or a [http://www.amazon.com/Hard-Drive-Transporter/dp/B002IY6B9U single drive case]. If you can't do this, wrap the drive in foam sheeting or bubble wrap (three times is good), and tape up the wra
 NB: This does NOT take account of chain-of-evidence issues, and I don't know anything about that, so take this only as informational.
 [[Category:Howtos]]

← Older revision		Revision as of 01:08, 23 February 2010
Line 12:		Line 12:

	# Use enter a [http://eshop.macsales.com/item/Newer%20Technology/FWU2ES2HDK/]		# Use enter a [http://eshop.macsales.com/item/Newer%20Technology/FWU2ES2HDK/]
		+	[[Category:Howtos]]