May 7th, 2011 by peter.bassill

Sometimes you just need to keep the forensics skilled honed. This series of posts will be around a number of drives obtained from ebay.

Imaging

Using an ubuntu 11.04 system with a pair of 1TB drivers as a base, we issue the following command to image the first drive:

dcfldd if=/dev/sdb conv=noerror,sync hashwindow=1M hash=md5 hashconv=after hashlog=/opt/forensics/hashlog.log split=640M splitformat=aa of=/opt/forensics/image.dd

May 3rd, 2011 by peter.bassill

Over the long bank holiday weekends and of course the middle three days I managed to spend some good quality time at home relaxing. Long walks, good food, some wine and of course the faithful company of my mad spaniel. Sadly the lady wife was working but this gave leeway to get up to all sorts of things.

Read the rest of this entry »