In this chapter, we will cover the following recipes:
- Drive acquisition in E01 format with FTK Imager
- Drive acquisition in RAW format with dc3dd
- Mounting forensic images with Arsenal Image Mounter
In this chapter, we will cover the following recipes:
Before you can begin analysing evidence from a source, it first of all needs to be imaged. This describes a forensic process in which an exact copy of a drive is made. This is an important step, especially if evidence needs to be taken to court, because forensic investigators must be able to demonstrate that they have not altered the evidence in any way.
The term forensic image can refer to either a physical or a logical image. Physical images are precise replicas of the drives they reference, whereas a logical image is a copy of a certain volume within that drive. In general, logical images show what the machine’s user will have seen and dealt with, whereas physical images give a more comprehensive overview of how the device works at a higher level.
A hash value is generated to verify the authenticity of the acquired image. Hash values are essentially cryptographic...
FTK Imager is an imaging and data preview tool by AccessData which allows an examiner not only to create forensic images in different formats, including RAW, SMART, E01, and AFF, but also to preview data sources in a forensically sound manner. In the first recipe of this chapter, we will show you how to create a forensic image of a hard drive from a Windows system in E01 format.
DC3DD (by Jesse Kornblum) is a patched version of the classic GNU dd utility with some computer forensics features. For example, the fly hashing with a number of algorithms, such as MD5, SHA-1, SHA-256, and SHA-512, showing the progress of the acquisition process, and so on.
You can find a compiled standalone version of DC3DD for Windows at SourceForge. Just download the ZIP or 7z archive, unpack it, and you are ready to go.
The steps for drive acquisition in RAW format using dc3dd are as follows...
Arsenal Image Mounter is an open source tool developed by Arsenal Recon. It can help a digital forensic examiner to mount a forensic image or virtual machine disk in Windows. It supports both E01 (and EX01) and RAW forensic images, so you can use it with any of the images we created in the previous recipes.
It's very important to note that Arsenal Image Mounter mounts the contents of disk images as complete disks. The tool supports all file systems you can find on Windows drives: NTFS, ReFS, FAT32, and exFAT. Also, it has temporary write support for images, which is a very useful feature, for example, if you want to boot the system from the image you are examining.