Tutorial - Computer Forensics Evidence Collection

Following up on the Tutorial - Computer Forensics Process for Beginners , here is a step-by-step tutorial on how to process a suspect computer to obtain dumps of RAM memory and Disk Drive using Helix Forensic CD.

Our suspect computer is a Windows XP Virtual Machine.
Our Example Forensic Toolkit
  • Helix forensic CD - your basic tool for the investigation
  • Evidence USB - 16 GB Capacity - for removing smaller evidence files from the evidence computer
  • Analysis computer - a windows laptop, VDK driver, for the analysis computer (if using windows) - this driver will enable you to mount a DD image created during the evidence collection
  • Sophos Antivirus and A-Squared Free Antispyware detector software for the analysis computer
I. Running state evidence collection
  1. Insert the Helix CD in the suspects computer CD/DVD drive. The Helix has an autorun so should start immediately, but be careful. If you are logged on as anything other then an administrator, you won't be able to make a dump of the full physical memory. So close the autorun, and choose the Run as option to start the Helix software, and provide the Administrator credentials.

  2. WARNING - DO NOT log off the session in order to log on as an Administrator! Ending a session will inevitably change and contaminate the content of RAM, since a lot of processes are closed upon logoff.

  3. When Helix starts, there will be a warning screen stating that Helix won't be able to protect the suspect OS environment from changing, since it's running within the suspect OS environment. But, since there is no other way to take a snapshot of the ram memory, just choose accept.

  4. You will see the startup screen of the Helix tool. The first icon is just a preview of system info, so it's not too useful. Go ahead to the second option – acquisition. It will prompt you for the source. Choose physical memory, and direct the output to the evidence USB drive.
  5. Acquisition will prompt you for the source to be dumped – choose Physical Memory
    It will ask for second confirmation and will start the dump

  6. After Memory Dump is finished, choose incident response (3rd icon on the Left menu) and click on the small arrow to go to the second screen (shown below). Run WinAudit

  7. Click on the only link and let it perform inventory of the system. Save the result as a PDF on your evidence USB

After Winaudit finishes, close it, and close the Helix mainwindow. It will ask whether you like to record all activities in a PDF file. Confirm that you wish to and save the PDF on your evidence USB.
The above process will create an MD5 hash of the memory dump on the evidence USB. Open this file and take note of the MD5 hash.

II. Disk drive evidence collection
  1. Turn off the computer ungracefully, pull the plug - this will prevent any possible shutdown scripts from running and possibly erasing data on the computer.
  2. Boot it up again, and from the BIOS select to boot from CD-ROM. In a real corporate investigation, you may need assistance of IT to provide passwords, since most corporate PC's are set-up with BIOS password and disabled from booting from CD to prevent possible information theft.

  3. Boot the Helix Linux OS

  4. When booted, select Adepto from the Forensics Menu

  5. Similarly to the memory dump above, select the drive you wish to make a dump of, and select your evidence USB as destination. For hash, you can choose severa. The example is with SHA1. After the dump is finished, choose the last tab (report) and choose to save the dump report as PDF to the evidence USB.

  6. Copy all files to your analysis computer, and verify the hashes of the memory and disk dumps again using md5sum and sha1sum, whichever you used initially.

  7. Using VDK, mount a copy of the disk image for investigation. The mount command is: vdk open path_to_dump_file\dump_filename.dd /L:free_drive_letter

HERE You can download and review the forensic log documents created in this tutorial (5.19 MB ZIP file)

Verification sums:

  • SHA1SUM c7d189a78a715fd96127677d39d5ace1d5854ea5
  • MD5SUM 9b61fad0cf4418175cb7e387c6962c49

This concludes the easy part of computer forensics - evidence collection. Shortinfosec will follow-up with exercises of the analysis part.

Related posts

Tutorial - Computer Forensics Process for Beginners

Talkback and comments are most welcome


Anonymous said...

Consider putting the article's authors name along with the date in which it was written. When is the follow up article coming out on analysis?

Yasmara.id said...

Wow thanks, this is vey usefull info

tips paid review said...

good writing nice tutorial

mlm software said...

Thank you very much to share this information. It is very useful and informative.

mlm software

Forex trading strategies said...

This is a realy nice tutorial. Like the reading. Tnx

Benjamin Wright said...

On the SANS Institute's forensics blog, I have published new methods for preserving and authenticating evidence in a cyber investigation. http://goo.gl/ramnu What is your opinion? --Ben

Computer Forensics Expert said...

Nice post! I like the helpful information you provide in your articles. I’ll bookmark your blog and check again here regularly. I’m quite certain I will learn plenty of new stuff right here! Good luck for the next!

Anonymous said...

Athena Forensics

Interesting read thanks for the post!

Anonymous said...

electronic cigarettes, e cig, electronic cigarettes, electronic cigarette, electronic cigarette, smokeless cigarettes

ayman zaid ibrahim said...

Thank you very much! My friends and family members will be happy after hearing about this
tas wanita branded
jam tangan online
jam tangan online murah

ayman zaid ibrahim said...

Thanks a lot for sharing. Will check back later for more of your articles.
jam tangan online
grosir baju anak
tas wanita branded

ayman zaid ibrahim said...

Things are very open and intensely clear explanation of issues. was truly information. Your website is very beneficial.
glenn colton
pretty social
jual jam tangan

ayman zaid ibrahim said...

thanks for his articel can menembah my insight on the internet,
cinta akik
portal bisnis online
kolektor batu akik
koleksi batu akik
pusat batu akik

Rosita Mae said...

thanks for sharing
Jam Tangan Online Murah
toko tas wanita online

Rosita Mae said...

thanks for sharing
Jam Tangan Online Murah
toko tas wanita online

Johan Syah said...

Thanks for sharing nice information with us. i like your post.
Toko Jam Tangan Online

Han Choe said...

Exceilent blog you have here but I was curious abou t if you knew of any communi ty forums tha t cover the same topics talked about in this article? I’d really like to be a part of online community where I can get advice from other experienced individuaIs that share the same interest. If you have any suggestions, please let me know. Appreciate it.....

Han Choe said...

I know where I'm going and I know the truth, and I don't have to be what you want me to be. I'm free to be what I want.Thankyou i reaIIy love it..

Han Choe said...

Thats a good' article, i usually amazed with' this thing, i asked myself about this opinion, I wish You'll a better articles that can make another people live..don't make the article feel rigit and isn't interesting and poor, i like to read this' article and i think this is "good".thank you' m'y brother...........

Imran Hashmi said...

Amazing! Its truly remarkable article, I have got much
clear idea concerning from this paragraph.

Adobe Creative Cloud Crack

bapak Taufan said...

Thanks for Sharing That... Sucses for You










Tahir Bahi said...

Thanks for sharing, nice blog and your article. plese visit me
IDM 6.5 Build 5 kegan
Trend Micro Antivirus
Windows 7 Product Key
Adobe Illustrator CC 2016 Crack

Tahir Bahi said...

Thanks for sharing, nice blog and your article. plese visit me
IDM 6.5 Build 5 kegan
Trend Micro Antivirus
Windows 7 Product Key
Adobe Illustrator CC 2016 Crack

atifabushra said...


google sketchup


spyhunter 4 email

Ruhama Putri said...

Thanks for Sharing That…. Sucses for You….



epson printer driver

Festival Blog said...

Happy diwali Images
Happy Dhanteras
happy diwali photos
happy diwali quotes
happy Diwali image
happy Diwali Picture
Diwali images

Anonymous said...

Thanks for your tutorials. It really helped me. CrazyBulk

Anonymous said...

I enjoyed this tutorial. You explain it in such an easy way. Does VO Genesis Work?

camera c360 said...

Great to come to your site as the information shared is good and is explained in simple words. Good stuff you are created, thank you for sharing a nice article.

Anonymous said...

I really love this information security short takes. Tubeloom Program

Anonymous said...

I totally agree with your point of view. 67 Steps E-book

Anonymous said...

Thanks for showing this. Many people still don't know about Computer Forensics Evidence Collection. Visit Here

Anonymous said...

Your tutorial is really wonderful and it is awesome. realonlinereview.com/hard-on-demand

Anonymous said...

I love the steps of tutorials you mentioned in your post. realonlinereview.com/get-bigger-penis-fast

Anonymous said...

I really enjoyed reading this vital information. This is wonderful. www.realonlinereview.com/penis-enlargement-bible

numpangpromo said...

This tutorial is really useful for me, thank you so much.

cara menggugurkan kandungan said...

This blog is so nice to me. I will continue to come here again and again. Visit my link as well. Good luck
http://www.jualobataborsiherbal.com/ obat aborsi
http://caramenggugurkankandungan.info/ cara menggugurkan kandungan
http://obataborsi59.com/ obat aborsi
http://obataborsi59.com/cara-menggugurkan-kandungan-dengan-cepat-dan-aman/ cara menggugurkan kandungan
http://obattelatdatangbulan.info/ obat telat datang bulan
http://klinikobataborsi.com/ jual obat aborsi
http://jualobatpenggugurkandungan.net/ obat penggugur kandungan
http://tandatandakehamilan.net/ tanda tanda kehamilan
http://tandatandakehamilan.net/cara-cepat-dan-selamat-menggugurkan-kandungan/ cara menggugurkan kandungan

Anonymous said...

very goood and great news for helping me so get more abou the life time info in below links veryu usefull every time

how to connect xbox one controller

samsung milk music


turn off flashlight

smart switch mobile samsung

how to take a screenshot on a samsung

giày tây nam said...

Thank you very much to share this information. It is very useful

giày tây nam cao cấp giày tây nam công sở giày tây nam

SYMBOLAB said...

Thank​ ​you​ ​for​ ​bringing​ ​more​ ​information​ ​to​ ​this​ ​topic​ ​for​ ​me.​ ​I’m​ ​truly​ ​grateful
and​ ​really​ ​impressed.​ ​​ ​Absolutely​ ​this​ ​article​ ​is​ ​incredible.​ ​And​ ​it​ ​is​ ​so​ ​beautiful.

sikat said...

Use this article to increase your knowledge . cara menggugurkan kandungan

gandianarta gandianarta said...

I like this article something very inspiring thanks.

younita ta said...

Articles that are very interesting and I really like your thoughts in article writing is very extraordinary.
raja poker

Unknown said...

good article raja poker

Unknown said...

I was able to find good information from your articles. call of world at war zombies apk.

http://tinderhacks.info said...

Best online Exam & Practice test software. QuizWave is a online examination software

This Simple Tinder Hack Gets Me 20 Matches Daily

http://csrracing2modapk.info said...

Download csr racing 2 mod apk unlimited money and gold

panda said...

Panda pop hack Apk

http://farmville2cheat.com said...

a deep researchable post.
Download Farmville 2 cheats and hack v 4.61

Anonymous said...

Quick vitamins terraria
Latest New Badoo Hacked Generator Free Apk Credit
Latest New Marvel contest of champions tips and tricks hack
Caesars casino cheat engine

Anonymous said...

My friends will like it. Thanks alot.
Will drinking green tea before bed help me lose weight
Download super flappy bird apk
Download clash of clans 7.1.1 mod apk unlimited gems
Is Saturday a business day for a bank
Download dating app cheat for tinder mod apk

michael tom said...

I discovered your blog website on google and appearance several of your early posts. Preserve the really good operate. I recently extra increase Feed to my MSN News Reader. Seeking toward reading a lot more from you down the road!… informatico forense en Madrid

Ali Rad said...

Excellent Post, thanks for sharing.
profile pics

Anonymous said...

Everyone love your blog, please keep it up. You are just too good.

Star Wars Galaxy of Heroes Apk + Mod 0.12.334385 android

Pirate kings cheat v1.4.apk free download

Golf Clash Mod Apk(Unlimited Money)Latest Free

Download Cooking Fever v2.8.0 (MOD, unlimited coins

Funny Pregnancy Quotes and Sayings to Fill Mommies With Chuckles

Jurassic World™: The Game v1.19.0 Mod Apk Money

Crossy Road: Ten tips, hints, and cheats to getting further faster

Anonymous said...

I LOVE Your Sharing Posts, Just Keep It Up. I AM Alwways Ready To Read And SHARE.








cara menggugurkan hamil said...

kandungan dengan cepat dan akurat terbukti ampuh untuk melunturkan janin kehamilan muda 1 minggu hingga 1 , 2 , 3 dan 4 bulan
obat penggugur kandungan adalah suatu bentuk proses berakhirnya kehamilan dengan dikeluarkannya janin ( fetus ) atau embrio sebelum memiliki kemampuan untuk berkembang dan bertahan hidup diluar rahim , sehingga bisa menyebabkan kematiannya pada janin
Disini akan kami beritahukan kepada Anda langkah cara cepat menggugurkan kandungan dengan cepat dan selamat adalah KURET dan obat aborsi
Kunyit memang tidak di baik di konsumsi oleh ibu hamil yang sedang hamil muda sehubungan dengan sifatnya untuk melancarkan haid , dan di percayai sebagai obat telat datang bulan
jual obat aborsi paling manjur Misiprostol Cytotec asli terbukti ampuh melunturkan janin kuat tanpa kuret dengan bersih untuk usia 1 , 2 , 3 sampai 4 bulan dengan aman
cara mencegah kehamilan Cara Mencegah Kehamilan saat berhubungan suami istri perlu perencanaan
cara menggugurkan hamil

Misty Moon said...

Enjoyed reading the article above , really explains everything in
detail,the article is very interesting and effective.Thank you and good
luck for the upcoming articles
clipping path
clipping path service
background removal
raster to vector

Designed by Posicionamiento Web