Folks,
one of my cases has been going on for almost half a year
now. Unfortunately, I now do have the need to transfer
the forensic dd image to another target disk which will
then become the case disk.
Is there anything other than the usual stuff (securely
erase the 'new' disk, create checksums before copying,
transfer the image using dcfldd, create checksums after
copying, securely erase the 'old' disk, document the whole
process) which needs to be done?
Am I missing anything important here?
Cheers,
Stefan.
--------------------------------------------------------
T.I.S.P. - Lassen Sie Ihre Qualifikation zertifizieren
vom 25.-29.02.2008 - http://www.secorvo.de/college/tisp/
--------------------------------------------------------
Stefan Kelm
Security Consultant
Secorvo Security Consulting GmbH
Ettlinger Strasse 12-14, D-76137 Karlsruhe
Tel. +49 721 255171-304, Fax +49 721 255171-100
[EMAIL PROTECTED], http://www.secorvo.de/
PGP: 87AE E858 CCBC C3A2 E633 D139 B0D9 212B
Mannheim HRB 108319, Geschaeftsfuehrer: Dirk Fox
-----------------------------------------------------------------
Uncover stealthy Trojans and malware in corporate web traffic
Anti-virus and URL filtering solutions provide only a limited solution to
evasive crimeware.
Qualify for a free audit for enterprises
www.finjan.com/RUSafe
