Six Articles on Electronic - Craig Ball

Craig Ball © 2007
Now, copy the data from the thumb drive, floppy or optical media back to a Windows machine
and the operating system has a bunch of empty metadata slots and pigeonholes to fill. Not
receiving a value for the jettisoned system metadata, it simply makes something up! That is, it
takes the last modified date and uses it to fill both the slot for last modified date and the slot for
last accessed date. That's worse. So, if we can't copy a file by…copying it, what do we do?
The answer is that you have to use tools and techniques designed to preserve system metadata
or you must record the metadata values before you alter them by copying. Various tools and
techniques exist to duplicate files on Windows systems without corrupting metadata. One that
Windows users already own is Microsoft Windows Backup. If you have Windows XP Pro
installed, you'll probably find Windows Backup in Accessories>System Tools. If you use
Windows XP Home Edition, Windows Backup wasn't automatically installed, but you can install
it from valueadd/MSFT/ntbackup on your system CD.
So far, we've talked only about copying a file and its system metadata. But each file comes
from a complex environment containing lots of data illuminating the origins, usage, manipulation
and even destruction of files. Some of this information is readily accessible to a user, some is
locked by the operating system and much more is inaccessible to the operating system, lurking
in obscure areas such as "unallocated clusters" and "slack space." When you copy a file and its
metadata, all of this information is left behind. Even if you copy all the active files on the hard
drive, you won't preserve the revealing latent data. To do that, you have to go deeper than the
operating system and create a forensically sound copy.
The classic definition of a forensically sound copy is that it's an authenticable duplicate of a
storage medium by a method that doesn't alter the source and reflects or can reliably
reconstruct every readable byte and sector of the source with nothing added, altered or omitted.
It's a physical, rather than a logical duplicate of the original.
A forensically sound copy may be termed a clone, drive image, bit stream duplicate, snapshot or
mirror. As long as the copy is created in a way that preserves latent information and can be
reliably authenticated, the name doesn't matter, though drive image denotes a duplicate where
the contents of the drive are stored or compressed in one or more files which can be
reconstituted as a forensically sound copy, and some use snapshot to mean a full system
backup of a server that doesn't preserve latent data.
Beware the misguided use of the Symantec Corp.'s Ghost or other off-the-shelf duplication
programs. Though it's possible to create a forensically sound drive clone with Ghost, I've never
seen it done correctly in the wild. Instead, IT personnel invariably use Ghost in ways that don't
preserve latent data and alter the original. Usually this flows from ignorance; occasionally, it's
an intentional effort to frustrate forensic examination.
There is no single approved way to create a forensically sound copy of a drive. Several
hardware and software tools are well suited to the task, each with strengths and weaknesses.
Notables include Guidance Software Inc.'s EnCase, the no-cost Linux "dd" (data dump) function,
AccessData Corp.'s Forensic Toolkit, X-Ways Software Technology AG's X-Ways Forensics,
Paraben Corp.'s Replicator and drive duplication devices from Intelligent Computer Solutions
Inc. and Logicube Inc. There are many different types of digital media out there, and a tool
appropriate to one may be incapable of duplicating another. You have to know what you're
doing and select the correct application for the job.
109