About this document
Forensic Imaging with CSI Linux by Iuliano Adrian Anton is a document available to read on EtoBox.
This document discusses write blocking and forensic imaging. It explains that using a write blocker or "forensic bridge" allows an analyst to create an exact copy of a drive for analysis while preventing any changes to the original evidence. It also notes the importance of wiping destination drives before imaging to avoid contamination. The lab section provides instructions for wiping a drive using the dcfldd/dd command line tool in Linux.
- Author
- Iuliano Adrian Anton
- Language
- EN