Data Acquisition

 Incident Scene: Data at Risk Before Collection

When an incident occurs, the first instinct often involves “looking around” the live system.
Unplanned clicks, root logins, or file copies can alter timestamps, logs, and unallocated space before anyone records a clean state.

Data acquisition solves this problem.
It focuses on collecting data in a controlled way so you preserve evidential integrity from the first action onward.

Foundations of Forensically Sound Acquisition

Data acquisition in a forensic context means more than just copying files.
It defines a documented process that collects data, protects it from change, and shows the court or internal review how you handled every step.

Key objectives:

• Minimize changes on the source device

• Capture as much relevant data as the scope allows

• Prove that collected data remains identical to the source

• Provide repeatable steps that another examiner can verify

Scope and Levels of Acquisition

Investigators choose a level of acquisition based on the case, time, and risk.

Common levels:

• Physical (bit-level) imaging: sector-by-sector copy of an entire disk or partition

• Logical acquisition: copy of files, folders, and partitions at the file-system level

• Targeted collection: focused copy of specific artifacts such as logs, email stores, or browser data

You use physical imaging for deep analysis and recovery.
You choose logical or targeted methods when time or access constraints limit full imaging.

Hashes and Validation

Cryptographic hashes prove that a copy matches its source.
During acquisition, you compute hashes such as SHA-256 for:

• The original device or image

• The acquired image or exported evidence sets

You then compare values.
When they match, you can show that the collected data stayed unchanged from acquisition through analysis and reporting.

Chain of Custody and Documentation

Technical integrity alone is not enough.
You must document who accessed a device, when they collected data, which tools they used, and where evidence traveled.

A basic chain of custody log includes:

• Case identifier and device description

• Dates and times of acquisition and transfers

• Names and signatures of handlers

• Hash values of key evidence files

You maintain these records alongside the images and exports to support later review.

Acquisition Techniques Across Devices

Different devices require different acquisition methods.
Laptops, servers, cloud services, and mobile hardware all present unique constraints.

Disk and Volume Imaging

For desktops and servers, disk imaging remains a primary method.
You often:

1. Power down the system if the situation allows.

2. Remove the drive and connect it to a forensic workstation.

3. Use a hardware write blocker to prevent any writes to the source disk.

4. Create a bit-level image and compute hashes during or after acquisition.

You then perform analysis on the image, not on the original disk.
This approach protects the evidence even if tools crash or analysts make mistakes.

Live Acquisition from Running Systems

Sometimes you cannot power a system down, such as a production server or a device holding volatile evidence.
You then perform live acquisition.

Typical actions include:

• Capturing RAM with a memory acquisition tool

• Gathering running process lists, active connections, and volatile logs

• Imaging logical volumes while the OS still runs, with as little disturbance as possible

Live acquisition inevitably changes the system to some extent.
You document those changes and explain why live collection offered the best balance between evidential value and risk.

Network and Cloud Collections

Modern investigations reach beyond local disks.
Data may live in cloud storage, SaaS platforms, or central log collectors.

In these cases, you:

• Use platform APIs to export logs, mailbox contents, or file histories

• Capture network traffic from taps or span ports when legally authorized

• Preserve provider metadata such as timestamps, account identifiers, and IP addresses

You treat exported archives as evidence objects and hash them like local images.

Software Workflow for Repeatable Acquisition

Manual actions increase the risk of errors.
A well-designed acquisition tool helps you follow a consistent process every time.

A typical workflow with a tool such as EOS SECURE Data Acquisition might look like this:

1. Start EOS SECURE Data Acquisition on a hardened workstation.

2. Identify connected disks, volumes, or remote sources through a clear device list.

3. Select the target and choose an acquisition type (physical image, logical set, or targeted profile).

4. Configure hashing options and evidence destination paths.

5. Run the acquisition while the tool records logs, hashes, and timestamps.

The tool then generates a report you can attach to your case documentation.
You avoid ad hoc commands that become hard to repeat or explain later.

Recommended Procedure for Windows Disk Acquisition