What do you think?
Rate this book
Practical Forensic Imaging: Securing Digital Evidence with Linux Tools
Forensic image acquisition is an important part of postmortem incident response and evidence collection. Digital forensic investigators acquire, preserve, and manage digital evidence to support civil and criminal cases; examine organizational policy violations; resolve disputes; and analyze cyber attacks.
Practical Forensic Imaging takes a detailed look at how to secure and manage digital evidence using Linux-based command line tools. This essential guide walks you through the entire forensic acquisition process and covers a wide range of practical scenarios and situations related to the imaging of storage media.
You'll learn how to:
-Perform forensic imaging of magnetic hard disks, SSDs and flash drives, optical discs, magnetic tapes, and legacy technologies
-Protect attached evidence media from accidental modification
-Manage large forensic image files, storage capacity, image format conversion, compression, splitting, duplication, secure transfer and storage, and secure disposal
-Preserve and verify evidence integrity with cryptographic and piecewise hashing, public key signatures, and RFC-3161 timestamping
-Work with newer drive and interface technologies like NVME, SATA Express, 4K-native sector drives, SSHDs, SAS, UASP/USB3x, and Thunderbolt
-Manage drive security such as ATA passwords; encrypted thumb drives; Opal self-encrypting drives; OS-encrypted drives using BitLocker, FileVault, and TrueCrypt; and others
-Acquire usable images from more complex or challenging situations such as RAID systems, virtual machine images, and damaged media
With its unique focus on digital forensic acquisition and evidence preservation, Practical Forensic Imaging is a valuable resource for experienced digital forensic investigators wanting to advance their Linux skills and experienced Linux administrators wanting to learn digital forensics. This is a must-have reference for every digital forensics lab.
Practical Forensic Imaging takes a detailed look at how to secure and manage digital evidence using Linux-based command line tools. This essential guide walks you through the entire forensic acquisition process and covers a wide range of practical scenarios and situations related to the imaging of storage media.
You'll learn how to:
-Perform forensic imaging of magnetic hard disks, SSDs and flash drives, optical discs, magnetic tapes, and legacy technologies
-Protect attached evidence media from accidental modification
-Manage large forensic image files, storage capacity, image format conversion, compression, splitting, duplication, secure transfer and storage, and secure disposal
-Preserve and verify evidence integrity with cryptographic and piecewise hashing, public key signatures, and RFC-3161 timestamping
-Work with newer drive and interface technologies like NVME, SATA Express, 4K-native sector drives, SSHDs, SAS, UASP/USB3x, and Thunderbolt
-Manage drive security such as ATA passwords; encrypted thumb drives; Opal self-encrypting drives; OS-encrypted drives using BitLocker, FileVault, and TrueCrypt; and others
-Acquire usable images from more complex or challenging situations such as RAID systems, virtual machine images, and damaged media
With its unique focus on digital forensic acquisition and evidence preservation, Practical Forensic Imaging is a valuable resource for experienced digital forensic investigators wanting to advance their Linux skills and experienced Linux administrators wanting to learn digital forensics. This is a must-have reference for every digital forensics lab.
324 pages, Paperback
First published January 1, 2016
11 people are currently reading
174 people want to read
Ratings & Reviews
Friends & Following
Create a free account to discover what your friends think of this book!
Community Reviews
Displaying 1 - 2 of 2 reviews
April 8, 2019
Odd book. Not sure what the goal of reading it is.
There is a lot of reference material there, including the various commands and a bit of extra information about taking images from or getting data off a variety of systems, including discussions of both hardware and software. Neat enough.
One thing that I was hoping to see would be what to do next, once you have the images, but that seems to have been out of scope for the book.
The main problem though, is who is this book for? If it's a reference for tools used for forensics, it's something that you only need a fraction of and won't necessarily stay up to date, but could be kept for that reason (it has a decent index). If it's to learn about forensics... not what you're probably looking for.
Interesting enough, not quite what I thought it was.
There is a lot of reference material there, including the various commands and a bit of extra information about taking images from or getting data off a variety of systems, including discussions of both hardware and software. Neat enough.
One thing that I was hoping to see would be what to do next, once you have the images, but that seems to have been out of scope for the book.
The main problem though, is who is this book for? If it's a reference for tools used for forensics, it's something that you only need a fraction of and won't necessarily stay up to date, but could be kept for that reason (it has a decent index). If it's to learn about forensics... not what you're probably looking for.
Interesting enough, not quite what I thought it was.
August 11, 2025
I really liked it! Very insightful on the topic and most importantly still relevant today.
Displaying 1 - 2 of 2 reviews