Summary
In this chapter, we covered several tools that can be used natively in Kali Linux and another tool called FTK Imager, which is native to Windows but can be installed in Kali Linux once Wine has been installed, for the acquisition of digital evidence. We first learned about the importance of being able to identify your devices so that you can accurately acquire a forensic copy or image of an evidence file using the fdisk - l command. For forensic analysis, bitstream copies of the evidence are needed, as these provide an exact copy of the evidence, bit by bit, which is why we used tools such as DC3DD, DD, and Guymager.
Firstly, we used DC3DD, an enhancement of the data dump tool, and through the Terminal, we performed quite a few tasks, including device imaging, hashing, verification, and drive wiping. We also performed acquisition using DD, which is very similar to DC3DD.
Our third tool, Guymager, has built-in case management abilities and also has many functional similarities...
