Narrator: In this lesson, I'm gonna show you
how to create a disc image from a USB thumb drive
using DD in the Linux, UNIX, or Macintosh system.
So, the first thing you need to do is
connect your USB thumb stick through a write blocker.
Now, if you don't have a write blocker,
for the purposes of this lab, you don't really need one.
Cause again, we're not doing a forensic image, necessarily.
Because we're not law enforcement.
But if you are working in the field,
you really do wanna use a write blocker.
So, I'm gonna plug it into my machine
and I'm gonna use fdisk dash L
to list the devices that I have.
You can see, I have an internal hard drive
of 8 gigabytes in size.
I have this virtual hard disk of 2.5 gigabytes in size.
And then this is my 2 gigabyte thumb stick
that I'm looking for.
S-D-B. S-D-B is the device name.
And it does have one partition on it
that is 1.9 gigabytes in size
and it is a FAT32 or Windows-type partition.
So, to create the disk image
what I'm gonna do, is do D-D and then
block size of 64 kilobytes.
My input file is whatever that disk is.
Now, this is where you have to decide what you wanna copy.
Do I wanna copy the entire disk or just the one partition?
Now, in my case, I do want the entire disk.
And the reason why is because
I want everything that is partitioned
and everything that's not partitioned.
So, if I'm going through, and I'm a legal investigator,
and I'm looking for hidden things,
sometimes those exist outside the partition.
So, by doing the slash S-D-B,
I get the entire disk drive,
all of the partitions and any of the blank space.
And then the output file, which in my case,
I'm just gonna call it usb2gb.dd,
and hit Enter, and it will start copying that drive.
This will usually take about 30 seconds
for every gigabyte you're gonna copy,
depending on your system speed.
So, I'm gonna go ahead and fast-forward
to the end of this copy, and we'll pick it up from there.
Alright, we're back and the disk has finished copying.
And we can see that here in the directory,
usb2gb.dd is a file.
So, what I wanna do at this point is create a hash.
Because again, that chain of custody is very important.
And the way to do that in Linux
is just doing md5sum, which is an MD5 hash,
and then the file name in our case,
usb2gb.dd, and hit Enter.
It will calculate how that hash will be
and output it there on the screen.
At that point, I would enter that into my log and
that becomes part of the chain of custody.
I would also wanna use a SHA1 or a SHA256
because MD5 is considered a little bit
weak in this day and age.
Now, if you use FTK Imager, which I'm gonna show you
in a few seconds here in the next video,
it will create those hashes for you
and create a documented trail of evidence for you
to allow you to use it.
(computer glitch tune)