Acquisition types

Acquisition is the step where data is copied from its source in a way that can be checked later (Module 1 explains how it differs from collection). A full image of a hard drive, a copy of selected mailboxes, a capture of a running computer's memory and an export from an online account are all acquisitions, and each captures some data, misses other data and changes something. This lesson describes the main types and how to choose between them. Lesson 4.2 explains how hash values protect the copy, and Lesson 4.3 how disk images are made.

Physical, logical and targeted

• Physical acquisition, also called a bit-stream or full-disk image, copies every sector of the device, in order: the partition table, every partition, unallocated space (areas the file system marks as free, which often still hold deleted data) and slack space (unused bytes at the end of a file's last cluster). It is the most complete copy.
• Logical acquisition copies files and folders as the file system presents them, with names, paths and timestamps. It is faster and smaller, but leaves out deleted files, unallocated space and slack space.
• Targeted or selective acquisition copies only items chosen by criteria, such as one user's mailbox, a project folder or files from a date range. It is common in electronic discovery (ISO/IEC 27050).

A volume image is a bit-stream copy of one partition rather than the whole drive. It keeps that partition's unallocated space and is often used to copy a decrypted volume from a running system.

On a solid-state drive, a physical image copies every block the drive presents, not the spare flash memory its controller keeps for itself, and blocks cleared by TRIM (Module 1) usually read back as zeros.

Dead-box and live acquisition

• Dead-box acquisition (also called static or offline) works on a system that is switched off: the drive is connected through a write blocker, or the computer is started from forensic boot media that does not write to it. Done correctly, it changes nothing on the source and can be repeated: imaging a healthy drive again gives the same hash value.
• Live acquisition works on a running system. It can capture memory (processes, network connections, encryption keys, malware that never touches the disk) and data on volumes unlocked at that moment.

Live acquisition has a cost. The tool runs on the system and changes it, and memory keeps changing while it is copied. The result cannot be repeated or checked against the source, because the source no longer exists in that state; the hash of a memory image protects it only from the moment of capture. Detailed notes make up for what cannot be repeated. The two are often combined: memory and unlocked volumes first, following the order of volatility (Module 1), then the drive after shutdown.

Local and remote acquisition

Most acquisitions are local: the examiner is with the device. Remote acquisition copies data over a network. In organizations, endpoint agents, small programs installed in advance on computers, can image a disk, capture memory or collect files from a machine in another country. This speeds up incident response but adds requirements:

• authorization for each machine and for any cross-border transfer (Module 2);
• an encrypted connection, and a hash computed on the source and again on the received copy;
• notes on the agent's own footprint, since it runs on the live system.

Mobile devices

Phones and tablets are almost always acquired while switched on, through their own operating system or a special start-up mode, so every mobile acquisition changes the device a little. Three levels are commonly described.

• Logical: data the operating system provides through its normal interfaces or backup function, such as contacts, messages and photos.
• File system (or full file system): a copy of the file system, including app databases and system logs that never appear in a backup. It often needs elevated access.
• Physical: a bit-for-bit copy of the flash memory. On many current devices user data is encrypted file by file, so a physical copy cannot be decrypted without keys the device protects.

NIST SP 800-101 describes further methods, from manual extraction (photographing the screen) to chip-off (removing the memory chip).

The lock state often decides what is possible. Modern phones encrypt user data with keys that depend partly on the passcode. Before the first unlock after a restart (BFU), most user data stays encrypted; after the first unlock (AFU), much more is accessible, even if the screen locks again. Hence a phone found switched on is kept charged and isolated (Module 3).

Cloud and online services

Data held by an online service cannot be imaged. Three routes are common:

• Provider export: the provider produces the data in response to a legal request, often with logs the user never sees.
• Account export with authorization: an authorized person signs in, with consent or another legal basis, and uses the service's download feature, recording each step.
• API collection: a tool uses the service's application programming interface (API) with authorized credentials to download items and their metadata, as organizations often do for their own business accounts.

Cloud acquisition is always logical: there is no unallocated space, and deleted items exist only while the provider retains them. Export formats and metadata depend on the service. Hash each export as soon as it is received.

Choosing a method

Choose by asking what the questions need, what could be lost, what the authorization allows and what is technically possible. A physical image keeps most options open; a targeted copy is often the proportionate choice for a server holding other people's data. Always record what was not acquired and why, so a reviewer can tell a deliberate limit from an oversight.

A worked example

Mei, an investigator at a fictional company, Northgate Freight, responds to suspected payroll fraud. The suspect's desktop is running with an encrypted drive, the payroll files sit on a server shared by 400 staff, and the suspect uses a hosted company email account.

1. Mei captures memory and an image of the unlocked volume, noting each command, and records the recovery key IT provides.
2. She shuts the desktop down and makes a physical image of its drive through a write blocker.
3. The server must stay online, so she makes a targeted copy of the payroll folders and access logs.
4. She collects the mailbox through the service's administrative export and hashes every output.

Her notes list what she left out, such as other users' folders, and why.

Exam focus: Know what physical, logical, targeted and volume acquisitions capture, and that only bit-stream images include unallocated and slack space. Tell dead-box from live acquisition and why a memory image cannot be verified against its source. Know the mobile levels (logical, file system, physical), BFU and AFU lock states, the routes for cloud data, and why examiners record what they did not acquire.