Evidence acquisition: disk, live system and remote collection
You take disk images in raw and E01 formats, collect volatile data from a live system in the right order, and pull evidence safely from a remote server over the network.
Level 201 · 15 lessons · 12 practice labs
Lessons
Planning acquisition
- Pull the plug or keep it running: live versus dead acquisition
- Order of volatility: what to collect first with RFC 3227
- The acquisition form: device, serial, clock offset, photos
- Short task: write an acquisition plan for a server incident
Image formats
- Raw, E01 and AFF4 images: differences and choosing
- Taking an E01 image with ewfacquire and filling in its metadata
- Verifying an image with ewfverify and ewfinfo
- Mounting an image read-only with ewfmount and losetup
- Short task: image one disk as raw and E01 and compare sizes and hashes
Live and remote acquisition
- A live response script: processes, connections, sessions, open files
- Memory first: capturing RAM on a live system with avml
- Working with trusted tools: never trusting the victim’s binaries
- Imaging over the network with ssh and dd
- Targeted collection instead of a full image: packaging key files
- Capstone: collect live data and the disk from a compromised server by the book
Practice labs
- Order by volatility: Order eight evidence sources from first to last to collect following RFC 3227.
- Shut down or leave running: Decide between live and dead acquisition in three scenarios and write the reasoning.
- An acquisition plan for a server incident: Write an acquisition plan with order, tools, storage and form for Ayçiçeği Gıda's compromised web server.
- Read image details with ewfinfo: Extract an E01 image's case number, examiner and hash with ewfinfo.
- Take and verify an E01 image: Acquire an image with ewfacquire filling in the metadata and verify it with ewfverify.
- Compare raw and E01: Acquire the same disk as raw and E01, compare sizes and content hashes and mount the E01 read-only.
- Collect processes and connections from a live system: Write the process, connection and session lists to timestamped files using trusted tools.
- Memory first: dump with avml: Take a memory dump with avml on a live lab server, hash it and enter it on the acquisition form.
- Write a live response script: Write a collection script that follows the order of volatility, hashes every output and touches the system as little as possible.
- Prepare a targeted collection package: Package logs, shell history and configuration files into one archive preserving timestamps.
- Image over the network: Image a remote lab server's disk with ssh and dd and compare hashes at both ends.
- Rule-compliant collection from a compromised server: Collect memory first, then live data, then disk from the lab server and document every step with chain of custody.
About this course
You take disk images in raw and E01 formats, collect volatile data from a live system in the right order, and pull evidence safely from a remote server over the network.
What you will learn
- Planning acquisition
- Image formats
- Live and remote acquisition
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.