Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

Rebuilding the RAID to analyse the drives may become unfeasible if an investigator
has used a Live CD with similar HPA issue to boot the drive. Because of all this,
another Linux distribution called BackTrack was used in this research to avoid the
problem of HPA being disabled by default. The Linux kernel used in BackTrack has
been patched to fix the problem.
5.1.6.3 Issue Of Hardware Write Blocker
Another problem that involved HPA hidden areas was with Tableau T35es Write
Blocker, the only write blocker that was available in the research laboratory. In test
cases that had HPA or DCO hidden areas, no write blocker was used. The standardised
forensic acquisition procedure requires a write blocker to be used at all time to prevent
any intentional or unintentional tampering with the evidence drive that would be
subsequently used in court. The Tableau T35es write blocker is able to detect and
override both HPA and DCO hidden areas but this defies the purpose of the testing
which is to analyse the behaviour of disk imaging tools when HPA and/or DCO are
present. The research made some efforts to prevent any tampering with the test drive.
As indicated in Step 3 and 5 shown in Table 5.1, the test drive would be hashed before
and after the forensic acquisition. The hash values computed before and after the
acquisition had to be matched to verify if data tampering on the test drive had
occurred.
5.1.6.4 Linux Forensics Live CDs
Helix 3 Pro is a Linux Forensic toolkit in the Live CD. AIR is also a constituent part
of another forensics Live CD toolkit called CAINE. Moll, Prokop, & Morgenstern
(2009) argued that Linux forensic toolkits are required to satisfy various requirements.
Firstly, the File system of the evidence device should not be automatically mounted at
boot up. The swap space (if any) in the evidence drive is not activated. Software RAID
arrays on evidence drives is not automatically activated at the operating system boot
up process (Maxim, 2009). Maxim (2009) also suggests that all the block devices are
set to read-only mode to avoid any write attempts to the evidence drive. Maxim (2009)
conducted the testing to assess whether the Linux Forensic Live CDs mount file
system during the start-up process. The testing results indicate that BackTrack 4 Pre-
109