SLAMorris Final Thesis After Corrections.pdf - Cranfield University

2.2.2 Tools used in Forensic Computing
During an investigation, tools play an important part in obtaining and analysing
data; anything an analyst uses to assist him during a case can be thought of as
a tool. Tools could be physical or software, however it is beyond the scope of
this research to discuss physical tools in depth. There are two categories of
software used by an analyst: those for researching the behaviour and structure
of an object and those used for identifying evidence; some tools may be used
for both purposes. This section examines software tools that are currently
available and discusses the requirements for creating a new forensic tool.
A virtual machine is a software version of a computer; it enables a virtual
instance of a computer to be customised and used like a standard machine.
Within a virtual machine it is possible to customise the hardware and software.
It is also possible to limit how the virtual machine interacts with its environment,
For example by restricting input devices or network access. Virtual machines
are commonly used by forensic analysts to determine the behaviour and
structure of files and software [Penhallurick, 2005], as they provide a safe test
environment where the analyst can monitor and control the variables being
assessed. One of the main advantages of using a virtual machine is the ability
to easily replicate the machine, which assists an analyst in ensuring the same
basic configuration is used throughout an experiment. A virtual machine can
also be used to obtain a live view of a hard drive image that has been acquired
[Bem, 2007]; this can provide an analyst with information about the layout of the
system that may not be immediately obvious from the image alone.
Live boot CDs can allow an analyst to view and analyse a hard drive without
altering it, specific forensic versions of the Linux operating system, such as
Penguin Sleuth and Helix, have been created [Forensics Wiki, 2013].Such CDs
provide appropriate tools for an analyst in a live boot format to enable them to
Page 17