Digital forensic examiners are investigators who are experts in gathering, recovering, analyzing, and presenting data evidence from computers and other digital media related to computer-based .They might work on cases concerning identity theft, electronic fraud,investigation of material found in digital devices ,electronic evidence, often in relation to cyber crimes.
Showing posts with label Tableau Forensic Duplicator. Show all posts
Showing posts with label Tableau Forensic Duplicator. Show all posts
DIGITAL FORENSICS:CCTV ForensicsDisk-to-Disk (clone) duplication
·Dissembling HD from CCTV machine and Duplicate to the
Blank HD by TD2
Tableau Forensic Duplicator Disk-to-Disk (clone)
·Save Log for Hash and none errors confirmation.
·Put the Blank HD into CCTV machine and check, the
result has shown that it can replay and record accordingly.
--- The scenario shows that we can use this method to clone the source and then acquire the hash log for integrity purposes. --
--- Hence, following the practice above, we can extract the video content from CCTV evidence. However, it is essential to gain requirements from the client because it helps to shorten the process. --
--- If we can bring the CCTV machine along with the evidence source, we can produce a potential result. --
เทคนิคการเตรียม hard disk ไว้สำหรับเตรียมเก็บข้อมูลหรือทำสำเนาข้อมูล คือการ Wipe ซึ่งเราจะใช้อุปกรณ์ Tableau Forensic Duplicator (TD2) ในการทดสอบครั้งนี้ เพื่อให้แน่ใจว่า hard disk ที่จะนำไปใช้สำหรับทำสำเนาข้อมูลไม่มีข้อมูลปนเปื้อนหรือสิ่งอื่นใดหลงเหลืออยู่ Hard disk
Forensic Duplicator TD2
Standard operations:
Disk-to-Disk (clone) duplication
Disk-to-File (image) duplication
Format
Wipe
Hash (MD5 or SHA-1)
1. Hard disk ที่จะทำการ Wipe ให้บันทึกรายละเอียด Model: WDC WD5000AAKX-00ERMA0
S/N: WD-WMC2E3267484
2. ทำการเชือมต่อ Hard disk กับอุปกรณ์ Tableau Forensic Duplicator (TD2)
Model: WDC WD5000AAKX-00ERMA0
S/N: WD-WMC2E3267484
Firmware Revision: 15.01H15
Capacity in sectors reported Pwr-ON: 976,773,168 (500.1 GB)
Capacity in sectors reported by HPA: 976,773,168 (500.1 GB)
Capacity in sectors reported by DCO: 976,773,168 (500.1 GB)
HPA in use: No
DCO in use: No
ATA Security in use: No
Cable/Interface type: SATA
ATA PIO mode: PIO 4
ATA DMA mode: UDMA 6
%20duplication.jpg "CCTV Forensics Disk-to-Disk (clone) duplication")
%20%20Save%20log.jpg "Disk-to-Disk (clone) save log")
%20duplication1.png "--- The scenario shows that we can use this method to clone the source and then acquire the hash log for integrity purposes. -- --- Hence, following the practice above, we can extract the video content from CCTV evidence. However, it is essential to gain requirements from the client because it helps to shorten the process. -- --- If we can bring the CCTV machine along with the evidence source, we can produce a potential result. --")
%20duplication2.png "CCTV Forensics Disk-to-Disk (clone) duplication")
%20duplication3.jpg "CCTV Forensics Disk-to-Disk (clone) duplication")
%20duplication4.jpg "CCTV Forensics Disk-to-Disk (clone) duplication")
