Defcon 13: RS, Forensic Data Acquisition Tools

Proper recovery of evidence can be critical to a successful investigation or prosecution. This talk focuses on the different tools and techniques that are used by US Law Enforcement to get an uncontaminated copy of digital evidence from a suspect machine. The goal of this presentation is to teach not only how to copy all the data from a suspect machine, but also to instruct on how to make sure that any evidence collected can be used in court. Both hardware and software based forensic acquisition tools will be covered, with the various strengths and weaknesses of each product discussed. RS investigates financial fraud within medical environments. Duties include participating in the execution of search warrants to recover computer base evidence. Because of the sensitivity of the medical data to be seized and liability issues involved, forensic images of suspect systems must be made quickly, on-site, in production medical environments, with minimal disruption to patient care.