Wednesday, August 30

Helix & Live View

I just finished a class on Incident Response and Computer Forensics, so this is very exciting to me.

In short, you can take Helix and create an image using dd. Depending on the incident, you may need to create a duplicate of the system in question. Live View is one way an investigator can use a .dd file for some further analysis, without altering the copy!

As part of my final project, I used Helix Live Acquisition software to create a copy of a logical drive. I remember thinking how cool it would be to take that copy and somehow run it in VMware.

Fast-forward a month, now we Live View. According to the Live View site:
Live View is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image or physical disk. This allows the forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk.
So is this forensically sound?
Because all changes made to the disk are written to a separate file, the examiner can instantly revert all of his or her changes back to the original pristine state of the disk. The end result is that one need not create extra "throw away" copies of the disk or image to create the virtual machine.
Sounds pretty nice.

Live View has been talked about here and here.

Get Live View here.
Get Helix here.

No comments: