Evidence Acquisition Tools
In the previous chapter, we learned that documentation and proper DFIR procedures are key in any investigation. These ensure the integrity of the investigation by providing proof of data authenticity and preservation of the original evidence and documentation, which can be used to achieve the same exact results if the usage of tools and methods is repeated.
In this chapter, we will focus on and demonstrate forensically sound techniques for the acquisition of data by creating bitstream copies of evidence inclusive of data hashes, and also perform evidence acquisition of the drives, RAM, and paging files using various tools.
This is the first technical step in DFIR investigations, so it is very important to familiarize yourself with the tools and processes for evidence acquisition that are covered in this chapter. Upon completion of this chapter, you will know how to perform formal evidence acquisitions for analysis, which will be covered in later chapters...
