Backtrack 4 R2 Digital Forensics DCFLDD

In this video I use the dcfldd application to copy a partition of one hard drive to an image file on another hard drive in Backtrack 4 R2. This program was created by the DOD Computer Forensics Lab as tool for data acquisitions. One thing to note, be sure you set the "if and "of" correctly as if they are reversed you will wipe your drive. I also make a md5 hash of the original file and of the copied file to verify the accuracy of the copied image. This application can be ran from the terminal, however the tool is located by clicking the Start Menu--Backtrack--Digital Forensics--Image Acquiring--DCFLDD. For more information visit http://lecturesnippets.com

Category:

Science & Technology

Tags:

• Backtrack 4
• Backtrack 4 R2
• bt4
• dcfldd
• dd
• Digial forensics
• Computer Forensics

[MasterO2]

2 questions: 1) the /dev/hda1 partition is unmounted before running this command, right?

2) When you booted Backtrack 4, at the GRUB menu, which mode did you start from?

[lecturesnippets]

@MasterO2

1) yes, it is not mounted when I run the command.

2) it should not matter if you boot to the default mode or forensics mode, they both should work. Use forensics if you want to keep the disk from changing at all when you boot up backtack.

[Screenfreezer]

Thanks!!

At last something new!! It is rare to find these kind of videos, most videos on youtube are always about the same topic (cracking WEP, metasploit, nmap etc...) 5/5

[lecturesnippets]

@Screenfreezer - Thanks for the comment. Let me know if there are any tools you need to see. I plan on covering most all of them starting with the Forensics Tools.

[pinguino123698745]

if u r running a live cd (u say that on another video), where does the 20GB get stored?

And if they are stored on the drive itself, can this somehow corrupt the data in it ?

[sexcation]

In regard to drives encrypted using Truecrypt in place, without using DOD 5220.22-M. How difficult is it for a forensic data lab to use a tool like this to view previous unencrypted info?

[DjAdam16]

@Screenfreezer Amen brother....

[sjnovick]

This is a great video. Thanks!