Skip to content

PC Acquisition

Evidence Integrity

Capture volatile RAM before powering off. Hash the source and forensic image; verify hashes match at validation. Analysis must use a working copy, never the original.

Chain of Custody

Document who handled the device, when RAM was captured, write-blocker serial numbers, and imaging tool versions.

Computers / PCs

Types of Acquisitions :

  1. Logical : Captures active file and data via OS without capturing the entire disk. This is useful for a quick capture. Evidence capture device size can be smaller than the evidence file system size
  2. Physical : Bit-by-bit copy that captures everything including unallocated space. This will take days depending on the size of the device. Capturing device should have the same size as that of the evidence device

Process overview :

[Diagram — add to assets/ if available]

1.Capture RAM (if PC is on)
  • Why capture the RAM?
  • The following information is obtained only from volatile data i.e the RAM and is lost once the computer is turned off
    • Program, files and applications executed
    • Decrypted passwords and content
    • Active web pages
    • Network Traffic
    • Fileless Malware Samples
    • Valuable info about the runtime state

Once RAM is captured for the PC, the computer can be shutdown and handed over to the Forensic Science Laboratory (FSL)

2. Remove Hard disk
3. Write-protect the Suspect Device

This is so that anything inserted into the device by the investigation officer does not make any change to the system , thus protecting the evidence

4. Acquire Non-volatile data
  • Copies of the hard disks are created (logical or physical)
  • Hash of the device is calculated
  • Hash of the image is calculated

Hashing is done to preserve integrity of the device
Two scenarios where hash is useful

  1. Prove that content was implanted in the court of law
  2. If the hash of the device/image is different at time of collection and at a later stage it can be proved that some content was modified since details like time, etc is included to create the hash
  3. Hash of Physical copy at one point in time should match the hash at another point in time
  4. This would help detect any errors while processing or any accidental modifications
5. Plan for Contingency
Create multiple copies of the evidence collected. Analysis should always be conducted in the copy and not the original
6. Validate Data acquisition

Done by comparing hash taken at the start and at the end