3MinMax Series Topic Review - Imaging a Microsoft Surface Pro

There is no second chance when seizing or acquiring data. Make sure you get it right the first time.

Portable devices bring their own set of challenges to the table. These devices are more ubiquitous than computers. Seldom is the case today that does not include a cellular device. Unfortunately, there is no standard for cellular operating systems. Even within brands, there can be vastly different data storage. This course section will introduce students to several devices and the tools that will acquire them.

Investigators and first responders should be armed with the latest tools, digital container access techniques, and enterprise methodologies to identify, access, and preserve evidence across a vast range of devices and repositories. They must also be able to scale their identification and collection across thousands of systems in their enterprise. Enterprise and cloud storage collection techniques are now a requirement to track activity that has been intentionally and unintentionally spread across many devices.

In this episode you will learn:

Accessing storage on a device you can’t take apart 

Entering UEFI on a Surface Pro Acquisition software 

Physical configuration of equipment needed for acquisition

The topic covered in the video below is just an excerpt of what the FOR498: Battlefield Forensics & Data Acquisition course teaches. For more information or to register for the course visit here

The SANS 3MinMax series with Kevin Ripa is designed around short, three-minute presentations on a variety of topics from within Digital Forensics, Incident Response, and to a lesser degree, Information Security. 

About the author: An investigator at heart, Kevin Ripa bought his first computer as a tool for writing reports for his private investigation agency. As he worked through typical user issues, the "why" of what was going wrong in his machine kept him up at night. So Kevin turned his investigative skills toward his computer and quickly became fascinated by the world inside of it. Now a 25-year veteran of the digital investigations field, Kevin's enthusiasm has not waned: "IT security and digital forensics still inspire me every day, and I can't wait to wake up in the morning and get to work! 

"Kevin is a SANS Certified instructor and the co-author of the SANS course FOR498: Battlefield Forensics and Data Acquisition. For more information about the course, visit:http://www.sans.org/FOR498

​If you would like to suggest a topic for the next 3MinMax episodes, please email 3minmax@sans.org or reach out to Kevin via twitter at @kevinripa (https://twitter.com/kevinripa​)

FOR498: Battlefield Forensics & Data Acquisition course

FOR498, a digital forensic acquisition training course, provides the necessary skills to identify the many and varied data storage mediums in use today, and how to collect and preserve this data in a forensically sound manner despite how and where it may be stored. It covers digital acquisition from computers, portable devices, networks, and the cloud. It then teaches the student Battlefield Forensics, or the art and science of identifying and starting to extract actionable intelligence from a hard drive in 90 minutes or less.

Demo the course here

Learn abut the course Certification (GBFA) here