Which command is the Best choice for creating a forensic backup of a Linux system?

The correct answer is D. Run from a bootable CD: dd if=/dev/hda1 of=/mnt/backup/hda1.img. Using dd from a bootable CD is the only forensically sound method of creating an image. Using tar does not capture slack space on the disk. Running any command from a compromised operating system will raise integrity issues.

Data Protection and Incident Response

Question

Options

ARun form a bootable CD: tar cvzf image.tgz /
BRun from compromised operating system: tar cvzf image.tgz /
CRun from compromised operating system: dd if=/ dev/hda1 of=/mnt/backup/hda1.img
DRun from a bootable CD: dd if=/dev/hda1 of=/mnt/backup/hda1.img

How the community answered

(61 responses)

A
3% (2)
B
2% (1)
D
95% (58)

Explanation

Using dd from a bootable CD is the only forensically sound method of creating an image. Using tar does not capture slack space on the disk. Running any command from a compromised operating system will raise integrity issues.

Topics

#forensic imaging#dd command#Linux forensics#evidence preservation

Community Discussion

No community discussion yet for this question.

Full GCED Practice