37
48 | Page
Ch a p t e r 6 - F o r e n s i c A c q u i s i t i o n
Copyright GetData Forensics Pty Ltd 2010 - 2015, All rights reserved.
Label: Physical drives are listed with their Windows device number.
Logical drives display the drive label (if no label is present then "{no
label}" is used). Image files show the path to the image.
Size:
The size column contains the size of the physical or logical device,
or the size of the image file.
(Note that the reported size of a drive is usually smaller than the
size printed on the drive label. This is because manufactures report
the size in a decimal number of bytes while the Operating System
reports the size in 1,024 chunks for each KB).
FS:
The File System on the drive, e.g. FAT, NTFS or HFS;
Type:
Describes the way in which the drive is connected to the computer.
An image file will show the type of image (e.g. EnCase® or RAW).
Acquisition of physical vs. logical device
In most situations, pending compliance with any overriding case specific legal
requirements, an investigator is most likely to select an image a physical device.
Imaging the physical device gives access to the content of the entire media, for
example, the space between partitions. Carrier, 2005, observes: ͞The rule of thumb is
to acquire data at the lowest layer that we think there will be evidence. For most cases,
an investigator will acquire every sector of a disk͟. (2 p. 48)
In specific circumstances, an investigator may need to acquire a range of sectors from
the device. In this case, start and end sector information in entered in the sector range
fields at the bottom of the source selection window.
To select the source:
1.
Highlight the required device or image file using the mouse;
2.
lick the ͞Next͟ button is clicked to proceed to the destination window.
6.2.6
2. SELECTING THE DESTINATION
The image destination screen, shown in Figure 30 below, is where the parameters for
the image file are set, including type, compression, name, location etc.
