Performing Forensic Analyses, Part 2

In "Performing Forensic Analyses, Part 1," June 2004, InstantDoc ID 42445, I showed you how to create a bootable CD-ROM that contains the Penguin Sleuth Kit and how to use that CD-ROM to create a digital copy, or image, of a compromised hard disk. Now let's look at how to perform a forensic analysis on that image by using the Penguin Sleuth Kit on your CD-ROM.

The Penguin Sleuth Kit includes two extremely useful utilities: the Sleuth Kit, which is a collection of forensic command-line tools, and Autopsy, which is the Web browser-based front end for the command-line tools. The Sleuth Kit and Autopsy use an evidence locker to store collected data and documentation. Thus, you need an external or writable hard disk for the evidence locker.

Forensic analysis is a time- and resource-intensive operation. If you'll be performing forensic analyses often, I recommend that you use a dedicated machine with Linux installed to do this work. However, if you'll be performing forensic analyses only on occasion, you can run the bootable CD-ROM from your workstation instead of installing Linux on a dedicated machine because the tools on the CD-ROM are Linux-based. . . .