An Ontology for Digital Forensics in IT Security Incidents - OPUS

4.1. FORENSICS BASICS 17
data. Both of this can lead to (un)intentional destruction of traces.[Vidas,
2007]
According to [Kruse and Heiser, 2001, pp 5 f] many investigators recommend
to pull the power plug to stop the computer and with it the malware.
This freezes the hard disk as it is and the malware can no longer pursue its
objective. Others recommend to take the snapshot from the live system because
then also the volatile information can be used. Yet others even prefer
a normal shut down process. Maybe a hybrid approach is acceptable that
rst captures the volatile information from the live system and then pulls
the plug. But there is no best practice for all cases.
4.1.2.1 Hard Disk
The data from the hard disk can be obtained from a live system or using
a hardware or software write block. A write block is used to prevent write
operations. Using a write block eliminates or at least reduces the risk of
changing data on the piece of evidence. The live system alternative is limited
by the access rights the investigator has to the system and by the problems
with live systems as mentioned before.
Both kinds of write blocks also have their limitations, hardware ones can
be very expensive and require the disk to be removed from the computer.
On the other hand software ones may be easier to use, as there is mostly
no need to remove the disk from the computer, but they are not as reliable
as hardware ones. An additional restriction for hardware blocks is that for
removing the disk the computer has to be powered o, which can lead to
losing volatile evidence.
To limit the loss of volatile evidence it should be acquired rst. The question
must be considered whether to pull the plug and risk damaged data or
shut down properly and risk that the malware cleans up traces. One limitation
also for both write block alternatives is that some data that is recorded
by the hardware itself, such as S.M.A.R.T. data, is changed nevertheless. The
Self-Monitoring, Analysis and Reporting Technology(S.M.A.R.T.) data is
acquired by the hardware itself to help prevent data loss. It includes values
that can be used to predict disk failure for example temperature and poweron
hours. If the disk is powered on the power-on hours value increases
regardless of any write block.
Another aspect when retrieving data from a hard disk is that it can have
hardware damages. One does not know whether operating such a disk is
safe or destroys more data. Most hard disks have a mechanism that can reestablish
consistency for a number of damaged storage units by using spare
units and error correction codes. But one does not know if the hardware destroys
evidence in doing this.[Council and Institute, 1998][Ewert and Schultz,
1992]