[Introduction to Incident Handling and Response] Investigator Ian gives you a drive image to investigate. What type of analysis are you performing?

The analysis of a drive image is a form of static analysis, also known as post-mortem analysis. This process involves examining a bit-for-bit copy of a storage device (the image) in a non-running state. The data is "at rest," allowing the investigator to conduct a thorough and repeatable examination of the file system, deleted files, and other artifacts without altering the original evidence or being constrained by a live operating system. This is the most common form of digital forensic analysis for non-volatile storage media.

A. Real-time: Real-time analysis involves monitoring a system for events as they happen, which is not applicable to a static, previously created drive image.
C. Dynamic: Dynamic analysis involves executing programs or code from the evidence (e.g., in a sandbox) to observe their behavior, not analyzing the static data on a disk image.
D. Live: Live analysis is performed on a running computer system to capture volatile data like RAM, running processes, and network connections, which is the opposite of analyzing a static image. ---

1. National Institute of Standards and Technology (NIST). (2006). Guide to Integrating Forensic Techniques into Incident Response (Special Publication 800-86).

Section 3.3.2

Post-Mortem Hard Drive Analysis

Page 21: "Post-mortem hard drive analysis is the most common form of digital forensic analysis. It involves analyzing the contents of a hard drive that has been taken out of a system. The same analysis can be performed on a bit-stream image of a hard drive." This directly defines the scenario as post-mortem (static) analysis.

2. Kent

K.

Chevalier

S.

Grance

T.

& Dang

H. (2006). Guide to Computer Security Log Management (NIST Special Publication 800-92).

Section 4.3

Data Collection

Page 4-4: The document distinguishes between collecting data from live systems and static data sources. It states

"Static data is data that does not change

such as a disk image..." This reinforces that a disk image is a source for static analysis.

3. Beebe

N. L. (2009). Digital Forensic Research: The Good

the Bad

and the Unaddressed. In H.S. Venter et al. (Eds.)

Proceedings of the 2009 Information Security for South Africa Conference (ISSA 2009).

Section 2.1

Live vs. Postmortem Forensics: The paper distinguishes the two approaches: "Postmortem forensics refers to the analysis of data at rest (i.e.

on a hard drive

flash drive

etc. that is not currently running)." This academic source clearly categorizes the analysis of a drive image as postmortem

which is synonymous with static analysis.

4. Garfinkel

S. (2010). Digital forensics research: The next 10 years. Digital Investigation

7

S64-S73. https://doi.org/10.1016/j.diin.2010.05.009

Section 3.1

Dead vs. Live Analysis: The paper discusses "dead analysis" (another term for static/post-mortem) as the examination of a disk image

contrasting it with "live analysis" performed on a running system. This further solidifies the terminology and concept.