chapter4dataacquisition-全文預(yù)覽
【正文】 RAID 1 – Designed for data recovery – More expensive than RAID 0 37 Understanding RAID (continued) ? RAID 2 – Similar to RAID 1 – Data is written to a disk on a bit level – Has better data integrity checking than RAID 0 – Slower than RAID 0 ? RAID 3 – Uses data stripping and dedicated parity ? RAID 4 – Data is written in blocks 38 Understanding RAID (continued) 39 Understanding RAID (continued) 40 Understanding RAID (continued) 41 Understanding RAID (continued) ? RAID 5 – Similar to RAIDs 0 and 3 – Places parity recovery data on each disk ? RAID 6 – Redundant parity on each disk ? RAID 10, or mirrored striping – Also known as RAID 1+0 – Combination of RAID 1 and RAID 0 42 Understanding RAID (continued) 43 Acquiring RAID Disks ? Concerns – How much data storage is needed? – What type of RAID is used? – Do you have the right acquisition tool? – Can the tool read a forensically copied RAID image? – Can the tool read split data saves of each RAID disk? ? Older hardwarefirmware RAID systems can be a challenge when you’re making an image 44 Acquiring RAID Disks (continued) ? Vendors offering RAID acquisition functions – Technologies Pathways ProDiscover – Guidance Software EnCase – XWays Forensics – Runtime Software – RTools Technologies ? Occasionally, a RAID system is too large for a static acquisition – Retrieve only the data relevant to the investigation with the sparse or logical acquisition method 45 Using Remote Network Acquisition Tools ? You can remotely connect to a suspect puter via a work connection and copy data from it ? Remote acquisition tools vary in configurations and capabilities ? Drawbacks – LAN’s data transfer speeds and routing table conflicts could cause problems – Gaining the permissions needed to access more secure subs – Heavy traffic could cause delays and errors 46 Remote Acquisition with ProDiscover ? With ProDiscover Investigator you can: – Preview a suspect’s drive remotely while it’s in use – Perform a live acquisition – Encrypt the connection – Copy the suspect puter’s RAM – Use the optional stealth mode ? ProDiscover Incident Response additional functions – Capture volatile system state information – Analyze current running processes 47 Remote Acquisition with ProDiscover ? ProDiscover Incident Response additional functions (continued) – Locate unseen files and processes – Remotely view and listen to IP ports – Run hash parisons – Create a hash inventory of all files remotely ? PDServer remote agent – ProDiscover utility for remote access – Needs to be loaded on the suspect 48 Remote Acquisition with ProDiscover ? PDServer installation modes – Trusted CD – Preinstallation – Pushing out and running remotely ? PDServer can run in a stealth mode – Can change process name to appear as OS function 49 Remote Acquisition with ProDiscover ? Remote connection security features – Password Protection – Encryption – Secure Communication Protocol – Write Protected Trusted Binaries – Digital Signatures 50 Remote Acquisition with EnCase Enterprise ? Remote acquisition features – Remote data acquisition of a puter’s media and RAM data – Integration with intrusion detection system (IDS) tools – Options to create a
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號(hào)-1