Evaluating A Selection of Tools for Extraction of Forensic Data: Disk ...

2. Linux distributions Ubuntu and Gentoo are required for better stability. (the
project used Ubuntu based Linux Distribution)
3. Perl/Tk must be installed. If Perl/Tk is not installed on your system, install-air
will attempt to download it itself.
4. Install program autoconf-1.10.1 and gperf
5. Install dc3dd (x.xx.x indicates the version of dc3dd. Our project used version
6.12.4)
a) Unpack the installation file:
$ tar zxvf dc3dd.x.xx.x.tar.gz
b) Navigate to the unpacked file directory and install:
$ ./configure
$ make
$ sudo make install
6. Installation of AIR (x.x.x indicates the version of AIR. Our project used
version 2.0.0)
a) Unzip the installation file:
$ sudo gunzip install-air-x.x.x.gz
b) Change the ownership of the installation file
$ chmod +x install-air-x.x.x
$ sudo ./install-air-x.x.x
4.6.2 Acquisition – AIR (Common in most Test Scenarios)
1. Connect the test hard drive to the Windows machine using the specified
physical interface. Connect to the hardware writeblocker if the test case is
required.
2. Open the Terminal and type in the command “sudo air” to run AIR.
3. In the field source device type in source drive (Use command “fdisk -l” to
verify). Partition can also be specified in here.
4. In the field destination device type in destination drive (Mount the destination
drive in the system)
5. Choose md5 as Hash 1 and sha1 as Hash 2. Choose Verify as Yes.
6. Select Use DC3DD and Split Image to 2047 Mbytes
147