How to make a simple forensic/investigation framework - Revision history

Atilaromero: /* Tips */

2009-08-31T19:32:34Z

‎Tips

Atilaromero: /* Tips */

2009-08-31T19:22:09Z

‎Tips

Atilaromero: /* Usage */

2009-08-31T19:21:17Z

‎Usage

Atilaromero at 20:53, 28 August 2009

2009-08-28T20:53:29Z

Atilaromero: Created page with 'Often, forensic labs are overloaded and investigators complains about the long waiting time. The solution for both professionals is to reduce the amount of seized material. But …'

2009-08-28T20:13:35Z

Created page with 'Often, forensic labs are overloaded and investigators complains about the long waiting time. The solution for both professionals is to reduce the amount of seized material. But …'

New page

Often, forensic labs are overloaded and investigators complains about the long waiting time. The solution for both professionals is to reduce the amount of seized material.

But how do you know if a computer is relevant without looking into it? And how to look into it in a fast and forensic acceptable way?

Many procedures are emerging around the world to allow the investigator to access seized computer data remotely, in a environment configured and maintained by the forensic professional. The investigator can perform an initial analysis, quickly pointing the most important computers among all computers seized, speeding the subsequent forensic exam, which is more time consuming, and reducing the amount of computers in which the exam will be made.

==Hardware==
* Server with large storage capacity - to keep the sized disk images.
* Samba server - to be accessed by the investigators.

==Software==
*GNU/Linux
*Samba
*SquashFS
*

← Older revision		Revision as of 19:32, 31 August 2009
Line 53:		Line 53:
	*May be necessary to specify the loop number in fstab, like 'ro,_netdev,loop=/dev/loopXX'.		*May be necessary to specify the loop number in fstab, like 'ro,_netdev,loop=/dev/loopXX'.
	*mkshashfs can be used to add new files to an existing squash image, so it is easy to group related materials together in a single file.		*mkshashfs can be used to add new files to an existing squash image, so it is easy to group related materials together in a single file.
		+
		+
		+	[[Category:Howtos]]

@@ Line 52: / Line 52: @@
 *The number of loop devices can be increased at boot with the 'max_loop=512' kernel option.
 *May be necessary to specify the loop number in fstab, like 'ro,_netdev,loop=/dev/loopXX'.
-*mkshashfs can be used to add new files to an existing squash image, so it is easy to group related materials together in a
+*mkshashfs can be used to add new files to an existing squash image, so it is easy to group related materials together in a single file.

@@ Line 38: / Line 38: @@
   /storage samba_server(ro)
 ===On the Samba server===
-*Add a line in /etc/fstab to
+*Add a line in /etc/fstab to access the squash files

@@ Line 6: / Line 6: @@
 ==Hardware==
-* Server with large storage capacity - to keep the sized disk images.
+* Storage server(s) - server(s) with large storage capacity to keep the sized disk images.
 * Samba server - to be accessed by the investigators.
@@ Line 13: / Line 13: @@
 *Samba
 *SquashFS
+*NFS(optional)