Jason: In this lesson, 2 2
I'm going to show you how to create a disk image 3 3
from a USB thumb drive 4 4
using dd in Linux, Unix, or Macintosh system. 5 5
So the first thing you need to do 6 6
is connect your USB thumbstick through a write blocker. 7 7
Now, if you don't have a write blocker 8 8
for the purposes of this lab, 9 9
you don't really need one 10 10
because, again, we're not doing a forensic image necessarily 11 11
because we're not law enforcement. 12 12
But if you are working in the field, 13 13
you really do want to use a write block. 14 14
So I'm going to plug it into my machine 15 15
and I'm going to use fdisk -l to list the devices that I have. 16 16
You can see I have an internal hard drive 17 17
of 8 gigabytes in size, 18 18
I have this virtual hard disk of 2 1/2 gigabytes in size, 19 19
and then this is my 2 gigabyte thumbstick 20 20
that I'm looking for, 21 21
sdb is the device name. 22 22
And it does have one partition on it, 23 23
that is 1.9 gigabytes in size 24 24
and it is a FAT32 or Windows type partition. 25 25
So to create the disk image, 26 26
what I'm going to do is do dd 27 27
and then block size of 64 kilobytes. 28 28
My input file is whatever that disk is. 29 29
Now, this is where you have to decide what you want to copy. 30 30
Do I want to copy the entire disk or just the one partition? 31 31
Now, in my case, I do want the entire disk. 32 32
And the reason why 33 33
is because I want everything that is partitioned 34 34
and everything that's not partitioned. 35 35
So if I'm going through and I'm a legal investigator 36 36
and I'm looking for hidden things, 37 37
sometimes those exist outside the partition. 38 38
So by doing the /sdb, I get the entire disk drive, 39 39
all of the partitions, and any of the blank space. 40 40
And then the output file, which in my case, 41 41
I'm just going to call it usb2gb.dd, 42 42
and hit Enter, and it will start copying that drive. 43 43
This will usually take about 30 seconds 44 44
for every gigabyte you're going to copy, 45 45
depending on your system speed. 46 46
So I'm going to go ahead and fast forward 47 47
to the end of this copy 48 48
and we'll pick it up from there. 49 49
All right, we're back and the disk has finished copying. 50 50
We can see that here in the directory, 51 51
usb2gb.dd is the file. 52 52
So what I want to do at this point is create a hash, 53 53
because, again, that chain of custody is very important. 54 54
And the way to do that in Linux is just doing md5sum, 55 55
which is an MD5 hash, 56 56
and then the file name, in our case, usb2gb.dd, 57 57
and hit Enter. 58 58
It will calculate how that hash will be 59 59
and output it there on the screen. 60 60
At that point, I would enter that into my log, 61 61
and that becomes part of the chain of custody. 62 62
I would also want to use a SHA-1 or a SHA-256 63 63
because MD5 is considered a little bit weak 64 64
in this day and age. 65 65
Now, first thing you're going to do 66 66
is download and install the FTK Imager. 67 67
Once you have that done, you'll go ahead and open it. 68 68
You will have to give it administrative permissions, 69 69
as I did just there, 70 70
and it will open up the program. 71 71
Now, FTK Imager does allow you to do 72 72
some a bit of looking through the files, 73 73
but in this case, we're going to first 74 74
look at collecting the image for a forensic image. 75 75
So you're going to go to File, 76 76
and then go down to Create Disk Image. 77 77
Then you'll select whether it's a physical drive, 78 78
a logical drive, an image file, 79 79
the contents of a folder, or multiple CDs and DVDs. 80 80
In my case, it is a physical drive, 81 81
because it's a USB thumb drive, 82 82
and I'll click Next, 83 83
and then I'm going to select the drive, 84 84
and in my case, it is PHYSICALDRIVE1, 85 85
it is a Memorex 2 gigabyte USB thumbstick, 86 86
and I'll hit Finish. 87 87
At this point, it'll ask where do I want to save the file 88 88
that I'm going to create, 89 89
so I'm going to go ahead and do it as a raw dd image 90 90
because any forensic tool can use that, 91 91
whereas E01 is reserved for Encase 92 92
and AFF is reserved for FTK. 93 93
Then select Next, 94 94
you can give it the information you want, 95 95
in my case, I'm just going to call this Case01, 96 96
evidence number, we'll call that 01, 97 97
unique description, USB 2GB Drive, 98 98
the examiner was my name, Jason Dion, 99 99
and any notes you may have. 100 100
Then click Next, 101 101
select where you want it to be stored, 102 102
in my case, I'm just going to save it directly to my desktop 103 103
so I can find it easily, 104 104
and then what is the file name going to be called. 105 105
I'm going to call it USB2GB.dd for the dd image. 106 106
And then I will hit Finish and I will Start, 107 107
and when I'm done, it's going to verify images 108 108
after they're created, 109 109
which will create the hash for me. 110 110
And we will go ahead and hit Start and off it will go. 111 111
Now, this will take a couple of minutes 112 112
because it is a 2 gigabyte thumbstick, 113 113
and 2 gigabytes is quite a bit of data to be imaging, 114 114
so it'll probably take us about five minutes. 115 115
So I will speed up the video 116 116
so you don't just here and watch it 117 117
count for five minutes, 118 118
and then I'll come back and we'll talk about it. 119 119
So as you can see, 120 120
it took about two minutes for it to copy 121 121
the two gigabyte drive, 122 122
and now it's going through and doing a verification, 123 123
which is creating the hash. 124 124
This is going to take us maybe about 20 seconds. 125 125
And as soon as it's done, we get our drive results. 126 126
So let's scroll up here and we can look at this. 127 127
So you'll have the name of the drive, 128 128
which in my case is USB2GB.dd.001, 129 129
which is the first file, 130 130
the sector count that's going to be involved, 131 131
you'll see the hash, 132 132
the reported hash and the computed hash, 133 133
and they both match, 134 134
and they should because that's what we just did. 135 135
And then it'll also give you a SHA-1, 136 136
computed hash and reported hash, 137 137
and there were no bad blocks in the image. 138 138
So we can go ahead and hit Close, 139 139
and then we can hit Close again. 140 140
Now, let me minimize this 141 141
and you'll be able to see the disk image. 142 142
It is going to sit here inside the Jason Dion folder, 143 143
which is my administrative account, and on the desktop. 144 144
You'll see that there are a couple of files here, 145 145
there is 001 and 002. 146 146
Now, what is the difference? 147 147
Well, if you'll notice, this is only a 1.5 gigabyte image. 148 148
That's where the software, by default, 149 149
is going to break these into chunks. 150 150
So if you have a 1 terabyte hard drive, 151 151
every 1.5 gigabytes or so, 152 152
it's going to chunk that into a separate file. 153 153
That's okay because it's going to be able to read that 154 154
as I bring that back into the software, 155 155
and then you'll see this text file, 156 156
which is just going to have the summary contents for us. 157 157
So it tells us it was created by FTK 158 158
and this is part of our chain of custody now. 159 159
It's going to tell us what the drive looked like, 160 160
it's going to tell us what the device looked like 161 161
and its serial number, 162 162
and it's going to give us the computed hashes 163 163
and the reported hashes that we did, 164 164
as well as our verified hashes. 165 165
So this was a hash before we took the image, 166 166
and this is the hash after we copy the image. 167 167
Now, if you want to open this file, 168 168
we're going to do that inside of FTK, 169 169
and we can analyze it. 170 170
So we'll do File, we'll Add Evidence Item, 171 171
it's going to be an image file this time, 172 172
because we just created the image, 173 173
and then we're going to find it, 174 174
and it is sitting inside my Jason Dion folder 175 175
on the desktop, 176 176
and you'll open up the first one, 001, 177 177
and it'll open 001 and 002 for me. 178 178
The drive shows up here in the Evidence Tree. 179 179
Now, as you open it, 180 180
you'll see the partitioned and the unpartitioned space, 181 181
so any files that may have been hidden 182 182
would show up in this unallocated space. 183 183
Now, if I open up the drive itself, it was FAT32, 184 184
and I can look at the root of the drive, 185 185
and you will see the different types of files on it. 186 186
Notice the ones with the X's here is .MP3. 187 187
This is a deleted file, 188 188
but I can see it because of this forensic techniques 189 189
that we're using. 190 190
And you can see all sorts of different music 191 191
that I used to have on this thumb drive 192 192
that have been deleted at some point, 193 193
and some of these files can be restored 194 194
using this forensic software. 195 195
The other thing we're going to be looking for here 196 196
is we can scroll down and see anything that's deleted, 197 197
you can see all of those files, 198 198
and you'll be able to see the ones that are not deleted, 199 199
so let's look at the date modified. 200 200
What was the most recently touched things on this system? 201 201
Well, this deleted folder was, 202 202
so maybe the bad guy was trying to hide something from us. 203 203
And so I can actually go in and restore that 204 204
and look at that. 205 205
Then you can see these other files that are sitting here. 206 206
Again, these are in the slack space 207 207
because they were deleted a long time ago. 208 208
Now this, again, is not a forensics course 209 209
where I'm going to teach you everything how to do this, 210 210
I just want to show you some of the capabilities 211 211
that you can go back and pull some of this information. 212 212
So if we open this, we can see inside this folder, 213 213
there was all of these different slides. 214 214
And so maybe if I open this slide, 215 215
oh, look, we can find this deleted folder 216 216
and see what it looked like. 217 217
It looked like an in brief for some sort of operation. 218 218
Now, what is this really? 219 219
Well, this was something I did for my church. 220 220
We did a spy night for the kids, 221 221
and these are some old files from that spy night folder 222 222
that we used. 223 223
But that's the idea here, 224 224
is that you can go back and restore some of these things 225 225
and be able to see what the bad guy was trying to hide 226 226
as you go through indeed the analysis. 227 227
That's the benefit of this, 228 228
and we're doing this off the disk image, 229 229
not the drive we originally collected 230 230
because that USB drive 231 231
is not even plugged into the computer anymore 232 232
'cause we don't need it.