What is forensic disk image?

A Forensic Image is a comprehensive duplicate of electronic media such as a hard-disk drive. A Forensic Clone is also a comprehensive duplicate of electronic media such as a hard-disk drive. Artifacts such as deleted files, deleted file fragments, and hidden data may be found in its slack and unallocated space.

How do you do a forensic disk image?

1. Open Windows Explorer and navigate to the FTK Imager Lite folder within the external HDD.
2. Run FTK Imager.exe as an administrator (right click -> Run as administrator).
3. In FTK’s main window, go to File and click on Create Disk Image.
4. Select Physical Drive as the source evidence type. Click on Next.

What types of data can be in forensic images?

Forensic images include not only all the files visible to the operating system but also deleted files and pieces of files left in the slack and free space.

What is a forensic imaging tool?

The process of forensic imaging is itself managed by “imaging software” like TIM (the Tableau Imager), EnCase Forensic or FTK Imager. Imaging software creates reads the source evidence through the write blocker and creates a “forensic image” on a destination device.

How do you analyze a forensic image?

The forensic analysis process includes four steps:

1. Use a write-blocker to prevent damaging the evidentiary value of the drive.
2. Mount up and/or process the image through forensics software.
3. Perform forensic analysis by examining common areas on the disk image for possible malware, evidence, violating company policy, etc.

How does write blocker work?

A write blocker is any tool that permits read-only access to data storage devices without compromising the integrity of the data. NIST’s general write blocking requirements hold that: The tool shall not allow a protected drive to be changed. The tool shall not prevent obtaining any information from or about any drive.

What is the step for disk imaging?

Forensic Image Extraction Exmple

1. Step 1: Go to File > Create Disk Image.
2. Step 2: Select Physical Drive , because the USB or hard drive you’re imaging is a physical device or drive.
3. Step 3: Select the drive you’re imaging.
4. Step 4: Add a new image destination.
5. Step 5: Select whichever image type you want.

How are digital forensic images collected?

Digital evidence can be collected from many sources. Obvious sources include computers, mobile phones, digital cameras, hard drives, CD-ROM, USB memory sticks, cloud computers, servers and so on. Non-obvious sources include RFID tags, and web pages which must be preserved as they are subject to change.

What do you do with a disc image file?

If you get the operating system as a disk image, which is a single file that you can download from the Internet, you can then burn it on a CD or DVD and, finally, you can use it to boot and install the operating system.