Forensic Imaging quickstarts!

• US National Institute of Standards and Technology (NIST)
• NIST has the program: Computer Forensic Tool Testing (CFTT)
• ISO (ISO/IEC 27037:2012) (provides guidlines)
• UK - Association of Chief Police Officers (ACPO) - Provides: ACPO Good Practice Guide for Digital Evidence
• DOJ maintains Electronic Crime Scene Investigation: A Guide fo First Responders
• Research journal (academic): Digital Investigation: The International Journal of Digital Forensic & Incident Response
• Conference: Digital Forensics Research Workshop (DFRWS)

• Assurance Advisory Council (IAAC) provides: Directors and Corporate Advisors' Guide to Digital Investigations and Evidence
• Legal: US Sarbanes-Oxley legislation

To note:

Each industry from healthcare to telecom to banking will have different standards and regulations.

For banking as an example: Monetary Authority of Singapore (MAS)

CFTT is for the establishment of methodologies for testing computer forensic software tools by development of general tool specifications, test procedures, test criteria, test sets, and test hardware.

• Accessible to anyone
• Examine the code is possible
• No need to sign nondisclosure agreements
• You can modify the source code
  • Easier to automate
  • You can more easily integrate with other software
  • You can modify the code to meet the requirements of a particular forensic lab
• You have mailing lists, chat other types of forums
• Ideal for academic
• Development community work with each other even if tehy compete

• Support is not reliable nor accurate nor trustworty (at times)
  • Commercial software often have 24/7 support and is more reliable
• Reaching out to the public to get help you could reveal sensitive information
• Interoperability with proprietary technologies with open source is often incomplete or not implementing some function properly
• Some project are abandoned or neglected (e.g.: OpenSSL)
• When in court the commercial software company can defend their product
• Open Source is better for educational reasons

• Practical Forensic Imaging | Securing Digital Evidence with Linux Tools by Bruce Nikkel (ISBN-13: 978-1-59327-793-2) Amazon.ca
• File System Forensic Analysis Amazon.ca

• Digital Forensics Using Kali Linux : Forensics Imaging Overview | packtpub.com | YouTube
• Digital Forensics with Kali Linux : Introduction to Forensic Imaging | packtpub.com | YouTube

• Home - DFRWS - DFRWS (Digital Forensic Research Workshop) is a non-profit, volunteer organization dedicated to bringing together everyone with a legitimate interest in digital forensics to address the emerging challenges of our field. DFRWS organizes digital forensic conferences, challenges, and international collaboration to help drive the direction of research and development.
  • Forensics Wiki (DFRWS)
• Disk Imaging | NIST - Test results of tools for forensic imaging.
• Brian Carrier: Digital Investigation / Forensics and Evidence Research
• The 6 Best Linux File Recovery Software | FOSS Linux
• CDRoller - Reading Data CD ( CDROM , CD-ROM XA ,etc.)
• Partition types
• Forensic Technology Center of Excellence - A program of the National Institute of Justice
  • Just Digital Forensics Program Development and Outlook (https://nij.ojp.gov/library/publications/just-science-podcast-just-digital-forensics-program-development-and-outlook)
  • Just Literature on Stress & Resiliency in Forensic Science (https://nij.ojp.gov/library/publications/just-science-podcast-just-literature-stress-resiliency-forensic-science)
• International Journal of Digital Evidence
• Scientific Working Group on Digital Evidence (SWGDE) Specified definitions and standards (including Standard Operating Procedures (SOPs)) for law enforcement
• US DOJ Electronic Crime Scene Investigation: A guide for First Responders
• University At Albany - Capital Region Cyber Crime Partnership (CRCCP)
• 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) (old article from 2006)
• New Approaches to Digital Evidence Acquisition and Analysis | National Institute of Justice
• Improving the Collection of Digital Evidence | National Institute of Justice (Usage of AI (deep learning))
• Device Forensics | Grier Forensics
• Digital Evidence and the U.S. Criminal Justice System | Office of Justice Programs
• Publications Listing | Office of Justice Programs
• Tweaking4All.com - Linux - HandBrake - Copy a DVD to MP4 or MKV file
• How to Rip DVDs With VLC - Linux Tutorials - Learn Linux Configuration
• Top 5 Linux DVD RIP Software - nixCraft
• How to Rip a DVD (with Pictures) - wikiHow
• Ubuntu Linux play encrypted DVDs - nixCraft
  • sudo apt-get install vlc xine mplayer libdvdread3
  • sudo /usr/share/doc/libdvdread3/examples/install-css.sh
• How to install libdvdcss in Ubuntu / Debian to play DVDs - nixCraft
• NTFS Undelete Test #1
• Digital (Computer) Forensics Tool Testing Images
• Awesome Forensics Resources. Almost 300 open source forensics tools, and 600 blog posts about forensics
• Digital Forensics Guide

• HFSExplorer | GitHub - HFSExplorer - An application for accessing HFS/HFS+/HFSX file systems. License: GPLv3+
• DMGExtractor | GitHub - DMGExtractor, a Java application for extracting the contents of Mac OS X disk images. License: LGPLv3+ Website
• catacombaeframework | GitHub - Common Java framework for Catacombae projects. License: LGPLv2.1+
• IOLVMPartitionScheme | GitHub - Mac OS X (10.5+) kernel extension which parses a Linux LVM2 layout and exposes single-device contiguous volumes as partitions. License: LGPL v2.1
• jfuse | GitHub - Java library for developing FUSE filesystems. License: LGPLv2.1+
• parted-freebsd | GitHub - GNU Parted patched to work on FreeBSD (configure with --disable-Werror (clang) or use gcc)
• catacombae - Has a bunch on tools that are useful for accessing drive data.
  • catacombae Blogspot - Blog
• macFUSE | GitHub - macFUSE allows you to extend macOS's native file handling capabilities via third-party file systems. Website
• Tuxera | GitHub - Disk tools. Website
• https://github.com/CIRCL
• The Sleuth Kit (TSK) & Autopsy: Open Source Digital Forensics Tools The Sleuth Kit | GitHub
• TestDisk, Data Recovery
• PhotoRec
• Ddrescue - Data recovery tool | GNU Project
• safecopy
• Redo Rescue: Backup and Recovery - GitHub - Main website
• Mondo Rescue - GPL disaster recovery solution
• DFORC2 (DFORC2 is a cloud-based digital forensics platform, developed at the RAND Corporation and backed by Autopsy and The Sleuth Kit. This repository is used to deploy the DFORC2 backend to AWS with Kubernetes. The backend also incorporates the autopsy-jar and spark-streaming-apps repositories. The DFORC2 frontend client comprises RAND's Linux-compati…)
  • DFORC2 | JNBDZ (fork)
• AcidRip
• HandBrake – Versatile DVD ripper and video transcoder for Linux sudo apt-get install handbrake handbrake-cli
• DVD::RIP – Front end for transcode and ffmpeg: sudo apt-get install dvdrip
• dvdbackup – Tool to rip DVD’s from the Linux command line sudo apt install dvdbackup
• thoggen – DVD backup utility (‘DVD ripper’) for Linux: sudo apt-get install thoggen
• libdvdcss2 – Simple foundation for reading DVDs – runtime libraries.
• libdvdnav4 – DVD navigation library.
• libdvdread4 – library for reading DVDs.
• MEncoder
• Hybrid | can convert most input formats to common audio & video formats and containers, see feature list for details.
• Tracking history of USB events on GNU/Linux
• Web browser forensics for Google Chrome/Chromium
• Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices
• MemLabs | Educational, CTF-styled labs for individuals interested in Memory Forensics

• basic-forensics-imaging-kit.jpg (.png)
• tux-inflated.jpg (.png)