Basic Forensic Acquisition Tools
Software and equipment for acquiring evidence
Basic forensic acquisition tools make it possible to capture digital evidence in a way that preserves its original integrity, generating exact bit-by-bit copies of disks, memory or mobile devices along with their corresponding hash value to show they weren't altered. In practice, tools such as hardware write blockers are essential when connecting an original disk, since they prevent the simple act of mounting it on a system from modifying metadata and contaminating the evidence before it's analyzed. There are both commercial and open-source options to cover different budgets and scenarios, from complete forensic suites to command-line utilities for quick captures of volatile memory on a compromised server. The important nuance is choosing the tool according to the context and urgency: in an active incident, a quick, less exhaustive capture before volatile evidence disappears may be preferable to waiting hours for a complete, perfect forensic acquisition.