Forensic Cop Journal Volume 2(3), Dec 2009
incidentally or deliberately. Any action applied to the evidence of storage media will notgive impact to the content of media. It means that the contents remain unchanged duringthe process of acquisition.
If the file has not been configured yet for the purpose of “write protect”,
the commandsbelow are added in the file of /etc/fstab. It could be put at the end of the file contents.
# Read Only Configuration/dev/sdb /media/sdbro auto noauto,user,ro,nosuid,nodev,uhelper=hal 0 0/dev/sdb1 /media/sdb1ro auto noauto,user,ro,nosuid,nodev,uhelper=hal 0 0/dev/sdb2 /media/sdb2ro auto noauto,user,ro,nosuid,nodev,uhelper=hal 0 0/dev/sdb3 /media/sdb3ro auto noauto,user,ro,nosuid,nodev,uhelper=hal 0 0/dev/sdb4 /media/sdb4ro auto noauto,user,ro,nosuid,nodev,uhelper=hal 0 0/dev/sdb5 /media/sdb5ro auto noauto,user,ro,nosuid,nodev,uhelper=hal 0 0
/media/sdbro is the mounting location of the evidence of storage media in which theevidence is usually marked as /dev/sdb, while /media/sdb1ro till /media/sdb5ro are themounting location of each partition which is marked as /dev/sdb1 to /dev/sdb5. The reasonwhy the number of partition is five is to anticipate the possibility of the storage media hasfive partitions. To prepare the mounting location as mentioned above, type the followingcommands.
mkdir /media/sdbromkdir /media/sdb1romkdir /media/sdb2romkdir /media/sdb3romkdir /media/sdb4romkdir /media/sdb5ro
After the configuration above has been added into the file /etc/fstab, the file is saved. Thefile has been ready for the purpose of forensically sound write protect. For furtherinformation, please access the forensic journal related to this topic athttp://forensiccop.blogspot.com.
Step 2: Ensuring the evidence mounted
After the process of configuring the file /etc/fstab finishes, attach the evidence of storagemedia to the analysis workstation through USB port. For the evidence of hard disk, USB toIDE cable could be used, while for memory card, the card reader could be utilized. If theevidence is a flash disk, just plug it in the USB port directly.Type the following command to check the position of the evidence or device attached.Please make sure the evidence is /dev/sdb, /dev/sdc or others in order to avoid the mistakeof signing the device. With this command, the number of partition of the evidence can beseen clearly including its size.