So, there I was …. Or, in other words, once upon a time. Or, …. Anyhow, I’m off doing a really “interesting” collection job. Its a mix of ediscovery and forensics, with all the typical issues – custodians available only for a day, unexpectedly large hard drives, systems that cannot come down at all, 3 Sony Vaios with just one power cord, etc. And, par for the course, no real idea of what I’m getting into prior to showing up on site, despite efforts to gather information. So, what made this fun collection rather than a nightmare? The ultimate collection kit:
- WinFE with FTK Imager, IEF, and X-Ways. This successfully imaged a Vaio laptop with dual SSDs in a RAID configuration without a hitch.
- Tableau TD1 – if this thing would write to multiple destination drives simultaneously, I’d kiss it. Even without the dual destinations, it is a rock solid imaging solution. (Bring a USB keyboard to make things a bit easier.)
- FTK Imager CLI – Ok, I know how to use dd and its brethren, but FTK is a bit more full featured, and being able to use one software tool across all the platforms was great.
- FTK Imager – FTK Imager doing logical folder collections made packaging the loose files very easy. And, again, one software tool.
- It will boot any Intel system, including Macs.
- It is forensically sound
- It is (relatively) easy to add your own tools
> diskpart (to run DiskPart) > list disks (to see the media connected to the system) > select disk “N” (where “N” is number of your destination drive) > online disk (to bring the disk online) > attributes disk clear READONLY (to allow writing to the disk) > list volume (in order to choose the volume on the destination disk to write) > select volume “V” (where “V” is the volume number to your destination disk) > attributes volume clear READONLY (to allow writing to the volume) > assign letter=Z (any letter you choose, to which your image will be written
Of course, there are all sorts of other things in my collection kit – two Pelican cases full of stuff, in fact, but everything mentioned here will fit in one case and will allow you to handle quite a bit of what might be thrown at you.