-: In the last lesson,
we talked about the order of volatility
and in that order of volatility,
we talked about the third one,
was hard drives and removable media,
because those are considered permanent,
or semipermanent storage.
Now in this lesson,
we're gonna talk about disk imaging
which is conducting a forensic image of that,
for later analysis.
And in the next lesson,
I'm gonna show you how to do that in a lab environment
using the dd tool and the FTK imager.
Now, when we talk about
imaging drives and removable media,
this is gonna conduct a bit by bit copy,
including the slack space and the unallocated space.
We're gonna use things like FTK imager,
EnCase imager, or dd,
and I'll show you two of those tools
in the next lesson.
Now dd is a standard UNIX and Linux tool,
it's found on UNIX, Linux, and OS X
because it is based off UNIX.
This is gonna copy the drive
using bit by bit copy
and it's used in a command line.
So for example,
I'm gonna have the command dd
and then bs-64k
which stands for block size of 64 kilobits.
If stands for the input file,
what do you wanna copy?
And there you can see
it's the dev, disk1, sda1,
and then the output file of
equals where you wanna copy it too.
In this case, I wanna copy it to
my first USB device
and copy it to an image name of sda1.img.
Again, I'll show you how this works
in the real world in the next lesson.
After that, we have FTK.
FTK is a commercial product
but they give it to you free to use.
It will actually document the chain of custody for you,
adds hashes,
and creates meta tags for later analysis.
FTK is a graphical user interface,
so you need something like Windows
as your operating system to use
and FTK's just an application on top of it.
Just like we had dd used in Linux and UNIX,
FTK is used for Windows.
Again, it's very easy to use
and allows you to connect something
like a USB drive to that Windows machine,
and create a software image of it
that can be later reused
in the FTK analyzing software,
or in EnCase.
Now, the side software tools,
we do have forensic drive duplicators
and we've mentioned this back in our toolkit lesson,
several lessons ago.
These are very expensive and dedicated devices.
They can be $10 or $15,000 dollars.
These will create images, hashes,
and collect the chain of custody metadata,
just like FTK does.
The big difference here though
is this is a dedicated machine,
so you're not tying up your forensic workstation
to create an image,
you can be doing analysis on other images
while you're collecting new images.
So they are heavily used in the field
especially in law enforcement capacities.
In the case of this one,
this is a Tableau which is probably
one of the most popular brands
of forensic disc duplicators,
or forensic disc imagers.
Now, Tableau makes a great product
and the way it will work
is you can connect it either
through USB or SETA, or IDE,
depending on what cable type you need.
Connects directly in here,
you'll connect the source drive,
you'll connect the imaging drive,
the blank drive,
and you'll go through the on prompts
on that touchscreen,
and be able to select what you want,
and it will go to town doing it.
Again, the larger the file size,
the longer it's gonna take.
When I've done drives of 500 gigabytes for instance,
it's taken eight to twelve hours,
so this is a long, slow process.
But it is one that has to be done
to collect all of the information on the drive,
not just the files,
but also the blank space.
Now, again, anytime you use one of these things,
you need to use a write block.
The Tableau has a write blocker built in
so you don't need to worry about it in that capacity
because it's built in to the drive duplicator.
But if you're gonna hook up a hard drive to your laptop,
or your forensic workstation to copy an image,
you need to use a write blocker.
This maintains data on the source disk,
and the hardware write blocker
is gonna be used to give you
the best forensic integrity
and will allow you to use it.
Now there are hardware and software ones,
you can see on the left,
this is a registry edit in Windows.
There's a registry value called Write Protect
and if you set it to one,
it will not let USB drives be written to,
it will only allow them to be read from.
This is not as forensically sound
as using a hardware write blocker,
as you can see on the write though.
So if you're doing this in a law enforcement capacity,
you need to use a hardware write blocker.
Now, the next thing you have to consider
when you're dealing with imaging hard drives,
is encrypted drives
because if you have an encrypted drive,
something with BitLocker or FileVault 2 from Apple,
you're gonna have problems opening that drive
if you don't have the password.
And brute forcing it can be very slow,
if you can ever find it
because some of those passwords
are long and strong,
and it can take hundreds or thousands,
or millions of years to crack through brute force.
So, when you capture the computer,
you wanna try to capture the computer
while it's logged in
because if it's logged in,
you can already have the drive encryption bypassed,
and you can do a live collect off of it.
If the computer is shut down,
that drive is now encrypted
and you have to have the key to unencrypt it.