Follow Us
  • YouTube Social  Icon
  • Twitter Classic
  • Google Classic
  • Facebook Classic

© 2019

New article published in Journal of Digital Investigation : Testing the forensic soundness of forensic examination environments on bootable mediad

July 23, 2014

Article Link:




In this work we experimentally examine the forensic soundness of the use of forensic bootable CD/DVDs as forensic examination environments. Several Linux distributions with bootable CD/DVDs which are marketed as forensic examination environments are used to perform a forensic analysis of a captured computer system. Before and after the bootable CD/DVD examination, the computer system's hard disk is removed and a forensic image acquired by a second system using a hardware write blocker. The images acquired before and after the bootable CD/DVD examination are hashed and the hash values compared. Where the hash values are inconsistent, a differential analysis is performed on the image files. The differential analysis allows us to quantify and explain the alterations made to the image files by the bootable CD/DVD examination. Our approach can be used to experimentally validate new bootable CD/DVD distributions as forensically sound. 

Please reload

Featured Posts

BigScreen and Unity Virtual Reality Attacks and the Man in The Room Attack

February 19, 2019

Please reload

Recent Posts
Please reload

Search By Tags