Low-Intrusive Consistent Disk Checkpointing: A Tool for Digital Forensics

Abstract

An important problem in digital forensics is to record a checkpoint of a disk drive mounted as a file system on a host machine without disrupting the disk s normal operations. We present a checkpointing methodology for a disk that has a Unix-like file system. While our algorithm is built around the Unix file system, it can be used to checkpoint disks formatted for other file systems such as NTFS, etc. Our algorithm satisfies several correctness conditions