I\'m new to forensic and I\'m trying to do a simple research about forensic in t

ID: 656317 • Letter: I

Question

I'm new to forensic and I'm trying to do a simple research about forensic in the cloud.

let's assume that I have access to an EC2 instance (whether a private key for a Linux instance or the username and password for Windows instance), and I used a software like FTK Remote Agent to acquire an image. Isn't this image the same as if I was able to go to the data center and physically connect and acquire the image?

I'm asking this because I was reading a paper in which the researchers were evaluating current tools (like FTK and EnCase) in cloud environment.They wanted to know whether these tools can acquire forensic data. So they created an EC2 instance, downloaded Apache on that instance, made some web pages and compromised the machine using a web-based vulnerability. Then they acquired an image and checked if they can find the timeline of their activities.

My other question: is it considered acceptable to install a tool or a service on a remote machine in order to acquire a forensic image? or is it considered to be damaging to the integrity of the evidence? (for example connecting to an EC2 instance using remote desktop and installing a tool that would let me connect to acquire a remote image).

Thanks.

Explanation / Answer

You are correct yes using something like FTK remote age is the same however you do have the added fun that it is potentially a live system so things are changing as you're working.

In a real world environment you're correct they contaminated the evidence (a BIG no-no), and would most likely be inadmissible in a court room. The most likely scenario would involve getting the courts permission to ask amazon for a snapshot / clone of that particular VM which can then be examined.

The best way is probably to use some of the VM's snapshot-ing abilities their are some tools which can work with the likes of VMDK files (VMWare) quite easily to allow investigators to carry out their duties.

Navigate

I\'m new to cryptography and have just encountered AES and SPN. I would like to

I\'m new to java and my professor throws us into the dark with these projects. I

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.

I\'m new to forensic and I\'m trying to do a simple research about forensic in t

Question

Explanation / Answer

Related Questions

Navigate