1 1 00:00:00,720 --> 00:00:01,560 In this lesson, 2 2 00:00:01,560 --> 00:00:04,440 I'm going to show you how to create a disk image 3 3 00:00:04,440 --> 00:00:06,150 from a USB thumb drive 4 4 00:00:06,150 --> 00:00:10,350 using dd in Linux, Unix, or Macintosh system. 5 5 00:00:10,350 --> 00:00:11,850 So the first thing you need to do 6 6 00:00:11,850 --> 00:00:15,990 is connect your USB thumbstick through a write blocker. 7 7 00:00:15,990 --> 00:00:18,000 Now, if you don't have a write blocker 8 8 00:00:18,000 --> 00:00:19,380 for the purposes of this lab, 9 9 00:00:19,380 --> 00:00:21,300 you don't really need one 10 10 00:00:21,300 --> 00:00:24,690 because, again, we're not doing a forensic image necessarily 11 11 00:00:24,690 --> 00:00:25,890 because we're not law enforcement. 12 12 00:00:25,890 --> 00:00:27,180 But if you are working in the field, 13 13 00:00:27,180 --> 00:00:28,860 you really do want to use a write block. 14 14 00:00:28,860 --> 00:00:30,720 So I'm going to plug it into my machine 15 15 00:00:30,720 --> 00:00:34,950 and I'm going to use fdisk -l to list the devices that I have. 16 16 00:00:34,950 --> 00:00:37,320 You can see I have an internal hard drive 17 17 00:00:37,320 --> 00:00:39,420 of 8 gigabytes in size, 18 18 00:00:39,420 --> 00:00:42,660 I have this virtual hard disk of 2 1/2 gigabytes in size, 19 19 00:00:42,660 --> 00:00:45,240 and then this is my 2 gigabyte thumbstick 20 20 00:00:45,240 --> 00:00:46,290 that I'm looking for, 21 21 00:00:48,210 --> 00:00:50,010 sdb is the device name. 22 22 00:00:50,010 --> 00:00:52,470 And it does have one partition on it, 23 23 00:00:52,470 --> 00:00:54,630 that is 1.9 gigabytes in size 24 24 00:00:54,630 --> 00:00:58,260 and it is a FAT32 or Windows type partition. 25 25 00:00:58,260 --> 00:01:00,510 So to create the disk image, 26 26 00:01:00,510 --> 00:01:03,000 what I'm going to do is do dd 27 27 00:01:03,000 --> 00:01:06,570 and then block size of 64 kilobytes. 28 28 00:01:06,570 --> 00:01:09,810 My input file is whatever that disk is. 29 29 00:01:09,810 --> 00:01:12,540 Now, this is where you have to decide what you want to copy. 30 30 00:01:12,540 --> 00:01:16,950 Do I want to copy the entire disk or just the one partition? 31 31 00:01:16,950 --> 00:01:20,160 Now, in my case, I do want the entire disk. 32 32 00:01:20,160 --> 00:01:21,000 And the reason why 33 33 00:01:21,000 --> 00:01:23,070 is because I want everything that is partitioned 34 34 00:01:23,070 --> 00:01:25,320 and everything that's not partitioned. 35 35 00:01:25,320 --> 00:01:28,320 So if I'm going through and I'm a legal investigator 36 36 00:01:28,320 --> 00:01:29,880 and I'm looking for hidden things, 37 37 00:01:29,880 --> 00:01:32,490 sometimes those exist outside the partition. 38 38 00:01:32,490 --> 00:01:36,960 So by doing the /sdb, I get the entire disk drive, 39 39 00:01:36,960 --> 00:01:39,750 all of the partitions, and any of the blank space. 40 40 00:01:39,750 --> 00:01:42,210 And then the output file, which in my case, 41 41 00:01:42,210 --> 00:01:45,480 I'm just going to call it usb2gb.dd, 42 42 00:01:45,480 --> 00:01:48,480 and hit Enter, and it will start copying that drive. 43 43 00:01:48,480 --> 00:01:51,450 This will usually take about 30 seconds 44 44 00:01:51,450 --> 00:01:53,610 for every gigabyte you're going to copy, 45 45 00:01:53,610 --> 00:01:55,320 depending on your system speed. 46 46 00:01:55,320 --> 00:01:56,520 So I'm going to go ahead and fast forward 47 47 00:01:56,520 --> 00:01:58,320 to the end of this copy 48 48 00:01:58,320 --> 00:02:00,450 and we'll pick it up from there. 49 49 00:02:00,450 --> 00:02:03,120 All right, we're back and the disk has finished copying. 50 50 00:02:03,120 --> 00:02:05,070 We can see that here in the directory, 51 51 00:02:05,070 --> 00:02:09,420 usb2gb.dd is the file. 52 52 00:02:09,420 --> 00:02:12,180 So what I want to do at this point is create a hash, 53 53 00:02:12,180 --> 00:02:15,570 because, again, that chain of custody is very important. 54 54 00:02:15,570 --> 00:02:19,170 And the way to do that in Linux is just doing md5sum, 55 55 00:02:19,170 --> 00:02:20,730 which is an MD5 hash, 56 56 00:02:20,730 --> 00:02:25,470 and then the file name, in our case, usb2gb.dd, 57 57 00:02:25,470 --> 00:02:26,640 and hit Enter. 58 58 00:02:26,640 --> 00:02:29,430 It will calculate how that hash will be 59 59 00:02:29,430 --> 00:02:31,260 and output it there on the screen. 60 60 00:02:31,260 --> 00:02:33,360 At that point, I would enter that into my log, 61 61 00:02:33,360 --> 00:02:36,060 and that becomes part of the chain of custody. 62 62 00:02:36,060 --> 00:02:39,390 I would also want to use a SHA-1 or a SHA-256 63 63 00:02:39,390 --> 00:02:41,790 because MD5 is considered a little bit weak 64 64 00:02:41,790 --> 00:02:43,530 in this day and age. 65 65 00:02:43,530 --> 00:02:44,790 Now, first thing you're going to do 66 66 00:02:44,790 --> 00:02:46,890 is download and install the FTK Imager. 67 67 00:02:46,890 --> 00:02:49,380 Once you have that done, you'll go ahead and open it. 68 68 00:02:49,380 --> 00:02:52,110 You will have to give it administrative permissions, 69 69 00:02:52,110 --> 00:02:53,610 as I did just there, 70 70 00:02:53,610 --> 00:02:55,320 and it will open up the program. 71 71 00:02:55,320 --> 00:02:57,330 Now, FTK Imager does allow you to do 72 72 00:02:57,330 --> 00:03:00,180 some a bit of looking through the files, 73 73 00:03:00,180 --> 00:03:01,770 but in this case, we're going to first 74 74 00:03:01,770 --> 00:03:04,800 look at collecting the image for a forensic image. 75 75 00:03:04,800 --> 00:03:06,570 So you're going to go to File, 76 76 00:03:06,570 --> 00:03:10,140 and then go down to Create Disk Image. 77 77 00:03:10,140 --> 00:03:12,180 Then you'll select whether it's a physical drive, 78 78 00:03:12,180 --> 00:03:14,580 a logical drive, an image file, 79 79 00:03:14,580 --> 00:03:18,630 the contents of a folder, or multiple CDs and DVDs. 80 80 00:03:18,630 --> 00:03:20,580 In my case, it is a physical drive, 81 81 00:03:20,580 --> 00:03:22,320 because it's a USB thumb drive, 82 82 00:03:22,320 --> 00:03:23,850 and I'll click Next, 83 83 00:03:23,850 --> 00:03:25,530 and then I'm going to select the drive, 84 84 00:03:25,530 --> 00:03:27,720 and in my case, it is PHYSICALDRIVE1, 85 85 00:03:27,720 --> 00:03:30,510 it is a Memorex 2 gigabyte USB thumbstick, 86 86 00:03:30,510 --> 00:03:32,340 and I'll hit Finish. 87 87 00:03:32,340 --> 00:03:35,100 At this point, it'll ask where do I want to save the file 88 88 00:03:35,100 --> 00:03:36,360 that I'm going to create, 89 89 00:03:36,360 --> 00:03:39,480 so I'm going to go ahead and do it as a raw dd image 90 90 00:03:39,480 --> 00:03:42,330 because any forensic tool can use that, 91 91 00:03:42,330 --> 00:03:45,120 whereas E01 is reserved for Encase 92 92 00:03:45,120 --> 00:03:47,940 and AFF is reserved for FTK. 93 93 00:03:47,940 --> 00:03:49,410 Then select Next, 94 94 00:03:49,410 --> 00:03:51,210 you can give it the information you want, 95 95 00:03:51,210 --> 00:03:53,537 in my case, I'm just going to call this Case01, 96 96 00:03:54,750 --> 00:03:57,270 evidence number, we'll call that 01, 97 97 00:03:57,270 --> 00:04:01,770 unique description, USB 2GB Drive, 98 98 00:04:01,770 --> 00:04:04,620 the examiner was my name, Jason Dion, 99 99 00:04:04,620 --> 00:04:06,180 and any notes you may have. 100 100 00:04:06,180 --> 00:04:07,950 Then click Next, 101 101 00:04:07,950 --> 00:04:09,900 select where you want it to be stored, 102 102 00:04:09,900 --> 00:04:12,360 in my case, I'm just going to save it directly to my desktop 103 103 00:04:12,360 --> 00:04:13,920 so I can find it easily, 104 104 00:04:13,920 --> 00:04:15,870 and then what is the file name going to be called. 105 105 00:04:15,870 --> 00:04:20,870 I'm going to call it USB2GB.dd for the dd image. 106 106 00:04:22,980 --> 00:04:26,640 And then I will hit Finish and I will Start, 107 107 00:04:26,640 --> 00:04:28,560 and when I'm done, it's going to verify images 108 108 00:04:28,560 --> 00:04:29,393 after they're created, 109 109 00:04:29,393 --> 00:04:31,680 which will create the hash for me. 110 110 00:04:31,680 --> 00:04:34,980 And we will go ahead and hit Start and off it will go. 111 111 00:04:34,980 --> 00:04:36,360 Now, this will take a couple of minutes 112 112 00:04:36,360 --> 00:04:38,850 because it is a 2 gigabyte thumbstick, 113 113 00:04:38,850 --> 00:04:41,430 and 2 gigabytes is quite a bit of data to be imaging, 114 114 00:04:41,430 --> 00:04:44,730 so it'll probably take us about five minutes. 115 115 00:04:44,730 --> 00:04:46,170 So I will speed up the video 116 116 00:04:46,170 --> 00:04:47,250 so you don't just here and watch it 117 117 00:04:47,250 --> 00:04:48,330 count for five minutes, 118 118 00:04:48,330 --> 00:04:50,723 and then I'll come back and we'll talk about it. 119 119 00:04:56,610 --> 00:04:57,450 So as you can see, 120 120 00:04:57,450 --> 00:04:59,910 it took about two minutes for it to copy 121 121 00:04:59,910 --> 00:05:01,410 the two gigabyte drive, 122 122 00:05:01,410 --> 00:05:03,180 and now it's going through and doing a verification, 123 123 00:05:03,180 --> 00:05:04,980 which is creating the hash. 124 124 00:05:04,980 --> 00:05:07,383 This is going to take us maybe about 20 seconds. 125 125 00:05:08,340 --> 00:05:11,250 And as soon as it's done, we get our drive results. 126 126 00:05:11,250 --> 00:05:12,990 So let's scroll up here and we can look at this. 127 127 00:05:12,990 --> 00:05:14,250 So you'll have the name of the drive, 128 128 00:05:14,250 --> 00:05:18,570 which in my case is USB2GB.dd.001, 129 129 00:05:18,570 --> 00:05:20,610 which is the first file, 130 130 00:05:20,610 --> 00:05:22,740 the sector count that's going to be involved, 131 131 00:05:22,740 --> 00:05:23,970 you'll see the hash, 132 132 00:05:23,970 --> 00:05:26,100 the reported hash and the computed hash, 133 133 00:05:26,100 --> 00:05:27,120 and they both match, 134 134 00:05:27,120 --> 00:05:29,550 and they should because that's what we just did. 135 135 00:05:29,550 --> 00:05:31,440 And then it'll also give you a SHA-1, 136 136 00:05:31,440 --> 00:05:33,540 computed hash and reported hash, 137 137 00:05:33,540 --> 00:05:35,850 and there were no bad blocks in the image. 138 138 00:05:35,850 --> 00:05:37,560 So we can go ahead and hit Close, 139 139 00:05:37,560 --> 00:05:40,110 and then we can hit Close again. 140 140 00:05:40,110 --> 00:05:41,460 Now, let me minimize this 141 141 00:05:41,460 --> 00:05:43,830 and you'll be able to see the disk image. 142 142 00:05:43,830 --> 00:05:46,320 It is going to sit here inside the Jason Dion folder, 143 143 00:05:46,320 --> 00:05:48,960 which is my administrative account, and on the desktop. 144 144 00:05:48,960 --> 00:05:51,480 You'll see that there are a couple of files here, 145 145 00:05:51,480 --> 00:05:54,120 there is 001 and 002. 146 146 00:05:54,120 --> 00:05:55,830 Now, what is the difference? 147 147 00:05:55,830 --> 00:05:59,340 Well, if you'll notice, this is only a 1.5 gigabyte image. 148 148 00:05:59,340 --> 00:06:01,290 That's where the software, by default, 149 149 00:06:01,290 --> 00:06:02,820 is going to break these into chunks. 150 150 00:06:02,820 --> 00:06:05,130 So if you have a 1 terabyte hard drive, 151 151 00:06:05,130 --> 00:06:07,380 every 1.5 gigabytes or so, 152 152 00:06:07,380 --> 00:06:09,900 it's going to chunk that into a separate file. 153 153 00:06:09,900 --> 00:06:12,420 That's okay because it's going to be able to read that 154 154 00:06:12,420 --> 00:06:14,250 as I bring that back into the software, 155 155 00:06:14,250 --> 00:06:15,900 and then you'll see this text file, 156 156 00:06:15,900 --> 00:06:18,480 which is just going to have the summary contents for us. 157 157 00:06:18,480 --> 00:06:20,487 So it tells us it was created by FTK 158 158 00:06:20,487 --> 00:06:22,830 and this is part of our chain of custody now. 159 159 00:06:22,830 --> 00:06:24,690 It's going to tell us what the drive looked like, 160 160 00:06:24,690 --> 00:06:26,460 it's going to tell us what the device looked like 161 161 00:06:26,460 --> 00:06:27,720 and its serial number, 162 162 00:06:27,720 --> 00:06:29,670 and it's going to give us the computed hashes 163 163 00:06:29,670 --> 00:06:31,830 and the reported hashes that we did, 164 164 00:06:31,830 --> 00:06:33,840 as well as our verified hashes. 165 165 00:06:33,840 --> 00:06:36,480 So this was a hash before we took the image, 166 166 00:06:36,480 --> 00:06:39,510 and this is the hash after we copy the image. 167 167 00:06:39,510 --> 00:06:41,850 Now, if you want to open this file, 168 168 00:06:41,850 --> 00:06:43,650 we're going to do that inside of FTK, 169 169 00:06:43,650 --> 00:06:45,360 and we can analyze it. 170 170 00:06:45,360 --> 00:06:48,510 So we'll do File, we'll Add Evidence Item, 171 171 00:06:48,510 --> 00:06:50,550 it's going to be an image file this time, 172 172 00:06:50,550 --> 00:06:52,140 because we just created the image, 173 173 00:06:52,140 --> 00:06:53,640 and then we're going to find it, 174 174 00:06:53,640 --> 00:06:56,700 and it is sitting inside my Jason Dion folder 175 175 00:06:56,700 --> 00:06:57,930 on the desktop, 176 176 00:06:57,930 --> 00:07:00,570 and you'll open up the first one, 001, 177 177 00:07:00,570 --> 00:07:03,690 and it'll open 001 and 002 for me. 178 178 00:07:03,690 --> 00:07:06,630 The drive shows up here in the Evidence Tree. 179 179 00:07:06,630 --> 00:07:08,340 Now, as you open it, 180 180 00:07:08,340 --> 00:07:11,490 you'll see the partitioned and the unpartitioned space, 181 181 00:07:11,490 --> 00:07:13,740 so any files that may have been hidden 182 182 00:07:13,740 --> 00:07:16,800 would show up in this unallocated space. 183 183 00:07:16,800 --> 00:07:20,130 Now, if I open up the drive itself, it was FAT32, 184 184 00:07:20,130 --> 00:07:22,860 and I can look at the root of the drive, 185 185 00:07:22,860 --> 00:07:25,620 and you will see the different types of files on it. 186 186 00:07:25,620 --> 00:07:28,770 Notice the ones with the X's here is .MP3. 187 187 00:07:28,770 --> 00:07:30,480 This is a deleted file, 188 188 00:07:30,480 --> 00:07:33,030 but I can see it because of this forensic techniques 189 189 00:07:33,030 --> 00:07:34,020 that we're using. 190 190 00:07:34,020 --> 00:07:35,730 And you can see all sorts of different music 191 191 00:07:35,730 --> 00:07:37,200 that I used to have on this thumb drive 192 192 00:07:37,200 --> 00:07:39,270 that have been deleted at some point, 193 193 00:07:39,270 --> 00:07:41,040 and some of these files can be restored 194 194 00:07:41,040 --> 00:07:43,350 using this forensic software. 195 195 00:07:43,350 --> 00:07:45,060 The other thing we're going to be looking for here 196 196 00:07:45,060 --> 00:07:48,270 is we can scroll down and see anything that's deleted, 197 197 00:07:48,270 --> 00:07:50,070 you can see all of those files, 198 198 00:07:50,070 --> 00:07:52,260 and you'll be able to see the ones that are not deleted, 199 199 00:07:52,260 --> 00:07:54,030 so let's look at the date modified. 200 200 00:07:54,030 --> 00:07:57,570 What was the most recently touched things on this system? 201 201 00:07:57,570 --> 00:07:59,400 Well, this deleted folder was, 202 202 00:07:59,400 --> 00:08:02,700 so maybe the bad guy was trying to hide something from us. 203 203 00:08:02,700 --> 00:08:04,500 And so I can actually go in and restore that 204 204 00:08:04,500 --> 00:08:06,150 and look at that. 205 205 00:08:06,150 --> 00:08:08,640 Then you can see these other files that are sitting here. 206 206 00:08:08,640 --> 00:08:10,230 Again, these are in the slack space 207 207 00:08:10,230 --> 00:08:13,350 because they were deleted a long time ago. 208 208 00:08:13,350 --> 00:08:15,390 Now this, again, is not a forensics course 209 209 00:08:15,390 --> 00:08:17,400 where I'm going to teach you everything how to do this, 210 210 00:08:17,400 --> 00:08:18,990 I just want to show you some of the capabilities 211 211 00:08:18,990 --> 00:08:21,900 that you can go back and pull some of this information. 212 212 00:08:21,900 --> 00:08:24,300 So if we open this, we can see inside this folder, 213 213 00:08:24,300 --> 00:08:26,460 there was all of these different slides. 214 214 00:08:26,460 --> 00:08:28,050 And so maybe if I open this slide, 215 215 00:08:28,050 --> 00:08:30,060 oh, look, we can find this deleted folder 216 216 00:08:30,060 --> 00:08:31,830 and see what it looked like. 217 217 00:08:31,830 --> 00:08:35,550 It looked like an in brief for some sort of operation. 218 218 00:08:35,550 --> 00:08:36,870 Now, what is this really? 219 219 00:08:36,870 --> 00:08:38,820 Well, this was something I did for my church. 220 220 00:08:38,820 --> 00:08:40,890 We did a spy night for the kids, 221 221 00:08:40,890 --> 00:08:43,800 and these are some old files from that spy night folder 222 222 00:08:43,800 --> 00:08:44,940 that we used. 223 223 00:08:44,940 --> 00:08:45,900 But that's the idea here, 224 224 00:08:45,900 --> 00:08:49,290 is that you can go back and restore some of these things 225 225 00:08:49,290 --> 00:08:52,110 and be able to see what the bad guy was trying to hide 226 226 00:08:52,110 --> 00:08:54,060 as you go through indeed the analysis. 227 227 00:08:54,060 --> 00:08:55,290 That's the benefit of this, 228 228 00:08:55,290 --> 00:08:57,240 and we're doing this off the disk image, 229 229 00:08:57,240 --> 00:08:58,950 not the drive we originally collected 230 230 00:08:58,950 --> 00:09:00,120 because that USB drive 231 231 00:09:00,120 --> 00:09:02,160 is not even plugged into the computer anymore 232 232 00:09:02,160 --> 00:09:03,360 'cause we don't need it.