-: In this demonstration you're going to learn
how a disk image is created during an instant response
or a forensic investigation.
Now I'm going to show you how we can do this
using the Forensic Toolkit Imager or FTK Imager.
To take a disk image of a hard drive or a USB thumb drive.
In my example, I'm going to take a disk image
of a 2 GB thumb drive with a windows machine
and then I'm going to show you a very basic introduction
to the Forensic Toolkit or FTK Tool
that'll allow you to do a forensic investigation
and find deleted files, hidden files and other things
from the evidence drive that we collected
as part of this instant response.
So, let's get started.
Now, first thing you're going to do is
download and install the FTK Imager.
Once you have that done, you'll go ahead and open it.
You will have to give it administrative permissions
as I did just there and it will open up the program.
Now FTK Imager does allow you to do
some a bit of looking through the files
but in this case we're going to first look at
collecting the image for a forensic image.
So you're going to go to file,
and then go down to create disk image.
Then you'll select whether it's a physical drive,
a logical drive, an image file, the contents of a folder,
or multiple CDs and DVDs.
In my case it is a physical drive
because it's a USB thumb drive and I'll click next.
And then I'm going to select the drive
and in my case it's PHYSICALDRIVE1,
it is a Memorex 2 GB USB thumb stick
and I'll hit finish.
At this point it'll ask where do I want to save
the file that I'm going to create.
So, I'm going to go ahead and do it as a Raw (dd) image
because any forensic tool can use that.
Whereas EO1 is reserved for encase,
and AFF is reserved for FTK.
Then select next, you can give it the information you want,
in my case I'm just going to call this Case01.
Evidence number we'll call that 01.
Unique description USB 2GB Drive.
The examiner was my name, Jason Dion
and any notes you may have.
Then click next, select where you want it to be stored,
in my case I'm just going to save it directly to my desktop
so I can find it easily.
And then what is the file name going to be called?
I'm going to call it USB2GB.dd
for the dd image.
And then I will hit finish and I will start.
And when I'm done it's going to verify images
after they're created which will create the hash for me.
And we will go ahead and hit start,
and off it will go.
Now this will take a couple of minutes
because it is a 2 GB thumb stick,
and 2 GB is quite a bit of data to be imaging.
So it will probably take us about five minutes.
So I will speed up the video so you don't have to sit here
and watch it count for five minutes.
And then I'll come back, and we'll talk about it.
So as you can see, it took about two minutes
for it to copy the 2 GB drive.
And now it's going through a verification
which is creating the hash.
This is going to take us maybe about 20 seconds.
And as soon as it's done, we get our drive results.
So let's scroll up here and we can look at this.
So you'll have the name of the drive
which in my case is USB2GB.dd.001
which is the first file.
The sector count that's going to be involved,
you'll see the hash,
the reported hash, and the computed hash.
And they both match, and they should
because that's what we just did.
And then it'll also give you a SHA1
computed hash and reported hash.
And there were no bad blocks in the image.
So we can go ahead and hit close
and then we can hit close again.
Now let me minimize this
and you'll be able to see the disk image.
It is going to sit here inside the Jason Dion folder,
which is my administrative account, and on the desktop.
You'll see that there are a couple of files here.
There is 001 and 002, now what is the difference?
Well if you'll notice this is only a 1.5 GB image.
That's where the software by default
is going to break these into chunks.
So if you have a 1 TB hard drive, every 1.5 GBs or so,
it's going to chunk that into a separate file.
That's okay because it's going to be able to read that
as I bring that back into the software.
And then you'll see this text file,
which is just going to have the summary contents for us.
So it tells us it was created by FTK.
And this is part of our chain of custody now.
It's going to tell us what the drive looked like,
it's going to tell us what the device looked like,
and it's serial number.
And it's going to give us the computed hashes
and the reported hashes that we did.
As well as our verified hashes.
So this was the hash before we took the image,
and this is the hash after we copy the image.
Now if you want to open this file,
we're going to do that inside of FTK and we can analyze it.
So we'll do file, we'll add evidence item,
it's going to be an image file this time.
Because we just created the image.
And then we're going to find it.
And it is sitting inside
my Jason Dion folder on the desktop.
And you'll open up the first one, 001,
and it'll open 001 and 002 for me.
The drive shows up here in the Evidence Tree.
Now, as you open it, you'll see the partitioned
and the unpartitioned space.
So any files that may have been hidden
would show up in this unallocated space.
Now if I open up the drive itself, it was FAT32.
And I can look at the root of the drive.
And you will see the different types of files on it.
Notice the ones with the X's here, this .mpg.
This is a deleted file but I can see it
because of this forensic techniques that we're using.
And you can see all sorts of different music
that I used to have on this thumb drive
that have been deleted at some point.
And some of these files can be restored
using this forensic software.
The other thing we're going to be looking for here
is we can scroll down and see anything that's been deleted,
you can see all of those files,
and you'll be able to see the ones that are not deleted.
So let's look at the date modified.
What was the most recently touched things on the system?
Well, this deleted folder was.
So maybe the bad guy was trying to hide something from us.
And so I can actually go in
and restore that and look at that.
Then you can see these other files that are sitting here.
Again, these are in the slack space
because they were deleted a long time ago.
Now this again is not a forensics course,
where I'm going to teach you everything, how to do this.
I just want to show you some of the capabilities
that you can go back and pull some of this information.
So if we open this we can see inside this folder.
There was all of these different slides.
And so maybe if I open this slide, oh look.
We can find this deleted folder and see what it looked like.
It looked like an inbrief for some sort of operation.
Now what is this really?
Well, this was something I did for my church.
We did a spy night for the kids
and these are some old files
from that spy night folder that we used.
But that's the idea here, is that you can go back
and restore some of these things
and be able to see what the bad guy was trying to hide
as you go through and do the analysis.
That's the benefit of this.
And we're doing this off the disk image
not the drive we originally collected.
Because that USB drive is not even
plugged in to the computer anymore.
Because we don't need it.