Question

There are PRO's and CON's to mounting and emulating the suspect system. Post a short discussion item on some PRO's and CON's of booting up a forensic image.

Answer 1

Pros of Mounting and Emulating Suspect System:

• We can get to know the contents of the System.
• We may find useful information about suspect.
• We may find clues for the investigation.
• We can backup the information obtained from Suspect system to Forensics Database.

Cons of Mounting and Emulating Suspect System:

• May end up with troubles, if accessed without warrant.
• Information present in the suspect system can be tampered or manipulated accidentally or intentionally.
• Some self destruct program may run, if it was mounted on another system, which can tamper useful evidence.

Forensic Image : Forensic image is a collection technique for PC's, used for collection of the data from PC regardless of the operating systems. In short its is a data backup technique.

Pros of Forensic Imaging:

• Used for keeping a copy of the data.
• Preserves integrity of data by verifying it after the copy operation.
• Used for comes to crash recovery.
• Preserves the data and operating system together, unlike traditional data backup,which maintains copy of the data.
• Forensic imaging is done using specialized software.

Cons for Forensic Imaging:

• Takes a lot of time for copying.
• Not an easy process.
• If there exists any inconsistency, the process of imaging starts from beginning.
• It needs more storage capacity.    
• Its sometimes difficult to choose a software and work with it.