1 1 00:00:00,300 --> 00:00:02,580 Disk image acquisition. 2 2 00:00:02,580 --> 00:00:06,150 In the last lesson, we talked about collecting live memory. 3 3 00:00:06,150 --> 00:00:07,020 In this lesson, 4 4 00:00:07,020 --> 00:00:09,000 we're going to move down the order of volatility 5 5 00:00:09,000 --> 00:00:11,580 and talk about collecting disk images. 6 6 00:00:11,580 --> 00:00:14,100 When you conduct a disk image acquisition, 7 7 00:00:14,100 --> 00:00:15,270 you're going to use a process 8 8 00:00:15,270 --> 00:00:17,940 that creates an image file of the system's disks, 9 9 00:00:17,940 --> 00:00:19,740 and these can then be analyzed to identify 10 10 00:00:19,740 --> 00:00:23,340 current, deleted, and hidden files on a given disk. 11 11 00:00:23,340 --> 00:00:25,320 Now notice, I didn't say hard drive. 12 12 00:00:25,320 --> 00:00:26,880 This is because when we talk about this, 13 13 00:00:26,880 --> 00:00:29,160 we can do this on any kind of disk. 14 14 00:00:29,160 --> 00:00:31,590 It can be on a hard drive, a solid state drive, 15 15 00:00:31,590 --> 00:00:33,120 or a USB thumb drive. 16 16 00:00:33,120 --> 00:00:34,680 You can even do this on something 17 17 00:00:34,680 --> 00:00:38,160 like an old school floppy disk drive or a tape backup drive. 18 18 00:00:38,160 --> 00:00:41,550 Any kind of magnetic or electronic media can be done 19 19 00:00:41,550 --> 00:00:43,500 through this disk image process. 20 20 00:00:43,500 --> 00:00:46,110 Now, when we go to perform our disk image acquisition, 21 21 00:00:46,110 --> 00:00:48,120 there are three different choices we have. 22 22 00:00:48,120 --> 00:00:50,010 We can do a live acquisition, 23 23 00:00:50,010 --> 00:00:52,470 a static acquisition by shutting the computer down, 24 24 00:00:52,470 --> 00:00:55,320 or a static acquisition by pulling the plug. 25 25 00:00:55,320 --> 00:00:57,570 Each of these has benefits and drawbacks, 26 26 00:00:57,570 --> 00:00:59,820 and we're going to cover them all in this lesson. 27 27 00:00:59,820 --> 00:01:01,740 Now, when we talk about live acquisition, 28 28 00:01:01,740 --> 00:01:04,230 this is capturing the contents of the disk drive 29 29 00:01:04,230 --> 00:01:06,180 while the computer is still running. 30 30 00:01:06,180 --> 00:01:07,590 Just like I talked about with memory, 31 31 00:01:07,590 --> 00:01:09,210 where we do a live acquisition of the memory 32 32 00:01:09,210 --> 00:01:10,800 before we shut down the computer 33 33 00:01:10,800 --> 00:01:13,110 because we would lose that contents in memory, 34 34 00:01:13,110 --> 00:01:14,040 well sometimes, 35 35 00:01:14,040 --> 00:01:16,770 you have to do a live acquisition of your disk. 36 36 00:01:16,770 --> 00:01:18,690 For example, if the disk is encrypted 37 37 00:01:18,690 --> 00:01:20,250 and you don't have the encryption key, 38 38 00:01:20,250 --> 00:01:22,110 but you're lucky enough to catch that system 39 39 00:01:22,110 --> 00:01:23,610 while it was still logged in, 40 40 00:01:23,610 --> 00:01:25,680 that disk is currently unencrypted, 41 41 00:01:25,680 --> 00:01:27,720 and so you can go in and capture it right now 42 42 00:01:27,720 --> 00:01:29,490 doing a live acquisition. 43 43 00:01:29,490 --> 00:01:31,860 Now, one of the challenges with a live acquisition 44 44 00:01:31,860 --> 00:01:33,420 is that while you're capturing data, 45 45 00:01:33,420 --> 00:01:34,560 the contents of the drive 46 46 00:01:34,560 --> 00:01:36,330 could be changed during acquisition. 47 47 00:01:36,330 --> 00:01:38,040 For example, maybe you're on the scene 48 48 00:01:38,040 --> 00:01:40,440 trying to collect information off a computer, 49 49 00:01:40,440 --> 00:01:42,150 but the person who owns that computer 50 50 00:01:42,150 --> 00:01:44,430 is logged in remotely and sees you doing it, 51 51 00:01:44,430 --> 00:01:45,840 and they start deleting files 52 52 00:01:45,840 --> 00:01:47,700 while you're trying to copy those files. 53 53 00:01:47,700 --> 00:01:48,630 This is what we're talking about 54 54 00:01:48,630 --> 00:01:49,680 when we talk about the contents 55 55 00:01:49,680 --> 00:01:51,060 of the drive could be changed, 56 56 00:01:51,060 --> 00:01:53,610 and so live acquisition does have its benefits, 57 57 00:01:53,610 --> 00:01:55,680 but it also has its drawbacks. 58 58 00:01:55,680 --> 00:01:57,600 The next one we have is static acquisition 59 59 00:01:57,600 --> 00:01:58,830 by shutting down. 60 60 00:01:58,830 --> 00:02:00,000 Now, this is when the computer 61 61 00:02:00,000 --> 00:02:02,430 is actually going to be shut down through the operating system, 62 62 00:02:02,430 --> 00:02:03,570 and you do this properly, 63 63 00:02:03,570 --> 00:02:05,610 and then the disk becomes acquired 64 64 00:02:05,610 --> 00:02:07,740 outside of the operating system. 65 65 00:02:07,740 --> 00:02:09,360 Now, for instance, if you're in Windows, 66 66 00:02:09,360 --> 00:02:11,640 you go to the start menu and you tell it to shut down, 67 67 00:02:11,640 --> 00:02:12,510 you wait for the computer 68 68 00:02:12,510 --> 00:02:15,510 to nice and quietly shut itself down, powers off, 69 69 00:02:15,510 --> 00:02:17,790 and then you could pull the hard drive out of the machine, 70 70 00:02:17,790 --> 00:02:19,230 hook it up to an imaging terminal, 71 71 00:02:19,230 --> 00:02:21,210 and then do your image that way. 72 72 00:02:21,210 --> 00:02:23,640 Now, there are benefits and drawbacks to this as well. 73 73 00:02:23,640 --> 00:02:26,010 Some malware can actually detect the shutdown, 74 74 00:02:26,010 --> 00:02:27,960 and they'll perform anti-forensics, 75 75 00:02:27,960 --> 00:02:31,020 like encrypting the files, like shuffling up the data, 76 76 00:02:31,020 --> 00:02:33,510 like deleting things or overriding things, 77 77 00:02:33,510 --> 00:02:36,510 and so this is something you do have to be worried about. 78 78 00:02:36,510 --> 00:02:39,810 Next, we have static acquisition by pulling the plug. 79 79 00:02:39,810 --> 00:02:40,740 This is going to occur 80 80 00:02:40,740 --> 00:02:43,080 by taking the system's power and disconnecting it 81 81 00:02:43,080 --> 00:02:45,840 by removing the power plug from the wall socket. 82 82 00:02:45,840 --> 00:02:48,180 Essentially, you're just unplugging the computer. 83 83 00:02:48,180 --> 00:02:50,220 Now, there's some benefits to doing this. 84 84 00:02:50,220 --> 00:02:53,250 Unlike live acquisition, nobody can be changing files, 85 85 00:02:53,250 --> 00:02:55,140 if you unplug the machine immediately, 86 86 00:02:55,140 --> 00:02:56,850 and unlike shutting down a computer, 87 87 00:02:56,850 --> 00:02:58,170 malware doesn't have a chance 88 88 00:02:58,170 --> 00:03:00,540 to try to delete files or cover up its tracks. 89 89 00:03:00,540 --> 00:03:03,420 Instead, you capture it right in the state it is in. 90 90 00:03:03,420 --> 00:03:05,580 But, there's a downside to this too. 91 91 00:03:05,580 --> 00:03:07,950 There is a risk that you can corrupt the data, 92 92 00:03:07,950 --> 00:03:09,870 but it's also more likely that you're going to be able 93 93 00:03:09,870 --> 00:03:12,300 to preserve the storage device's contents. 94 94 00:03:12,300 --> 00:03:14,520 So which of these three should you perform, 95 95 00:03:14,520 --> 00:03:16,050 that's really the question. 96 96 00:03:16,050 --> 00:03:17,610 Well, if you have time at the scene, 97 97 00:03:17,610 --> 00:03:20,070 you may decide to perform a live acquisition 98 98 00:03:20,070 --> 00:03:22,950 and then one of the two types of static acquisitions. 99 99 00:03:22,950 --> 00:03:25,500 This way, you can get the best of both worlds. 100 100 00:03:25,500 --> 00:03:27,510 Now, there are two types of acquisitions 101 101 00:03:27,510 --> 00:03:29,400 when I mention the word acquisition. 102 102 00:03:29,400 --> 00:03:31,050 I can do a physical acquisition, 103 103 00:03:31,050 --> 00:03:33,150 or I can do a logical acquisition. 104 104 00:03:33,150 --> 00:03:35,250 Now, when I talk about a physical acquisition, 105 105 00:03:35,250 --> 00:03:37,830 this is a bit-by-bit copy of the disk. 106 106 00:03:37,830 --> 00:03:40,860 This includes every non-bad sector on that target disk, 107 107 00:03:40,860 --> 00:03:43,740 including any deleted files or hidden data. 108 108 00:03:43,740 --> 00:03:45,540 Anything that's on that hard drive 109 109 00:03:45,540 --> 00:03:47,970 or that solid state drive or that USB drive 110 110 00:03:47,970 --> 00:03:49,890 is going to be copied doing this, 111 111 00:03:49,890 --> 00:03:52,620 and that's a great thing about doing a physical acquisition. 112 112 00:03:52,620 --> 00:03:54,930 Now, the downside is it takes awhile to do one of these 113 113 00:03:54,930 --> 00:03:56,970 because you're copying a bit-by-bit 114 114 00:03:56,970 --> 00:03:59,100 of every single thing on that disk. 115 115 00:03:59,100 --> 00:04:01,530 For instance, the computer I'm recording this on right now 116 116 00:04:01,530 --> 00:04:03,510 has a one terabyte hard drive. 117 117 00:04:03,510 --> 00:04:05,970 That computer, if you were going to do a bit-by-bit copy, 118 118 00:04:05,970 --> 00:04:08,550 would take you several hours to make that copy. 119 119 00:04:08,550 --> 00:04:10,200 Whereas, if I had only maybe 50 120 120 00:04:10,200 --> 00:04:12,360 or 100 gigabytes stored on that computer, 121 121 00:04:12,360 --> 00:04:14,670 you'd only have to copy the 50 or 100 gigabytes, 122 122 00:04:14,670 --> 00:04:16,140 if you go and do it the other way, 123 123 00:04:16,140 --> 00:04:18,360 which is a logical acquisition. 124 124 00:04:18,360 --> 00:04:20,340 This way, you're not copying all that storage space, 125 125 00:04:20,340 --> 00:04:22,170 you're only copying the files. 126 126 00:04:22,170 --> 00:04:23,880 Logical acquisition is going to copy 127 127 00:04:23,880 --> 00:04:25,800 your files and folders from partitions 128 128 00:04:25,800 --> 00:04:29,190 using the file system table that's stored on the media. 129 129 00:04:29,190 --> 00:04:32,310 Now, the good thing about this is it's a lot faster to copy, 130 130 00:04:32,310 --> 00:04:35,430 but the bad thing is any files that were marked as deleted 131 131 00:04:35,430 --> 00:04:36,780 are going to be missed. 132 132 00:04:36,780 --> 00:04:38,730 Now, this brings us to an important concept, 133 133 00:04:38,730 --> 00:04:40,200 which is file deletion. 134 134 00:04:40,200 --> 00:04:41,760 Did you know that when you delete a file, 135 135 00:04:41,760 --> 00:04:43,350 it's not really gone? 136 136 00:04:43,350 --> 00:04:45,810 All you're doing is removing the marker from the table 137 137 00:04:45,810 --> 00:04:47,400 that points to that file. 138 138 00:04:47,400 --> 00:04:48,900 So if you think about it like a book, 139 139 00:04:48,900 --> 00:04:50,430 you have a book with 10 chapters in it, 140 140 00:04:50,430 --> 00:04:51,750 and you go to the first couple pages 141 141 00:04:51,750 --> 00:04:53,707 and you find the table of contents and it says, 142 142 00:04:53,707 --> 00:04:57,090 "If you want to read chapter 10, go to page 85," 143 143 00:04:57,090 --> 00:04:58,740 and you then flip over to page 85, 144 144 00:04:58,740 --> 00:05:00,270 and you start reading chapter 10. 145 145 00:05:00,270 --> 00:05:02,070 Well, our file systems and hard drives 146 146 00:05:02,070 --> 00:05:03,570 work the exact same way. 147 147 00:05:03,570 --> 00:05:05,940 When you want to look at this video file, for instance, 148 148 00:05:05,940 --> 00:05:07,140 you're connecting to my server, 149 149 00:05:07,140 --> 00:05:09,337 and my server goes on its hard drive and says, 150 150 00:05:09,337 --> 00:05:11,640 "You want video file number 123," 151 151 00:05:11,640 --> 00:05:14,340 and it knows that's located in this spot on the hard drive. 152 152 00:05:14,340 --> 00:05:16,890 It pulls it, and then gives it to you to read. 153 153 00:05:16,890 --> 00:05:18,667 Now, if I deleted that marker that says, 154 154 00:05:18,667 --> 00:05:19,920 "Here's where it's located," 155 155 00:05:19,920 --> 00:05:21,360 the file's still on the hard drive, 156 156 00:05:21,360 --> 00:05:23,280 you just don't have any way to access it. 157 157 00:05:23,280 --> 00:05:24,750 And that's exactly what happens 158 158 00:05:24,750 --> 00:05:26,910 when we start marking files for deletion. 159 159 00:05:26,910 --> 00:05:29,047 We're going to talk more about this in a future lesson, 160 160 00:05:29,047 --> 00:05:31,020 when we talk about data carving, but for now, 161 161 00:05:31,020 --> 00:05:32,700 just remember that when you delete something, 162 162 00:05:32,700 --> 00:05:34,500 it's not truly gone. 163 163 00:05:34,500 --> 00:05:36,210 The next major idea we need to talk about 164 164 00:05:36,210 --> 00:05:39,000 in disk acquisition is write blockers. 165 165 00:05:39,000 --> 00:05:40,920 Now a write blocker is a forensic tool 166 166 00:05:40,920 --> 00:05:44,310 that prevents the capture or analysis device or workstation 167 167 00:05:44,310 --> 00:05:47,640 from changing any data on the target disk or media. 168 168 00:05:47,640 --> 00:05:48,990 What does this mean? 169 169 00:05:48,990 --> 00:05:50,460 Well, if I took your hard drive 170 170 00:05:50,460 --> 00:05:53,790 and simply plugged it into my computer using a USB drive, 171 171 00:05:53,790 --> 00:05:55,890 I could then read and write data to that drive, 172 172 00:05:55,890 --> 00:05:56,723 and that'd be bad 173 173 00:05:56,723 --> 00:05:58,500 because if you had the evidence on that drive, 174 174 00:05:58,500 --> 00:06:00,090 I might write over it. 175 175 00:06:00,090 --> 00:06:02,340 So we want to make sure we block the ability to write, 176 176 00:06:02,340 --> 00:06:04,200 and that's what a write blocker does. 177 177 00:06:04,200 --> 00:06:06,750 Now, write blockers can be either dedicated hardware 178 178 00:06:06,750 --> 00:06:08,400 or a software-based solution. 179 179 00:06:08,400 --> 00:06:09,990 It depends on what you're going to use. 180 180 00:06:09,990 --> 00:06:12,120 If you're working as a forensics professional though, 181 181 00:06:12,120 --> 00:06:14,790 you are almost always going to use a hardware solution 182 182 00:06:14,790 --> 00:06:17,910 because they're foolproof and they work every single time. 183 183 00:06:17,910 --> 00:06:19,590 Some of the software-based solutions, 184 184 00:06:19,590 --> 00:06:20,970 they could be circumvented 185 185 00:06:20,970 --> 00:06:23,010 with the appropriate tools and technology, 186 186 00:06:23,010 --> 00:06:24,150 and so this is why a lot of people 187 187 00:06:24,150 --> 00:06:26,400 like to rely on hardware-based write blockers 188 188 00:06:26,400 --> 00:06:27,930 in the forensics community. 189 189 00:06:27,930 --> 00:06:30,240 So, what does a hardware write blocker look like? 190 190 00:06:30,240 --> 00:06:32,130 Well, this is one that I personally have. 191 191 00:06:32,130 --> 00:06:34,380 This is my forensic USB bridge. 192 192 00:06:34,380 --> 00:06:36,540 Now, if I was going to connect your USB thumb drive 193 193 00:06:36,540 --> 00:06:38,970 or your USB hard drive to my computer, 194 194 00:06:38,970 --> 00:06:41,040 I would plug it into this bridge on one side, 195 195 00:06:41,040 --> 00:06:43,770 and then from this bridge, I would plug it into my computer. 196 196 00:06:43,770 --> 00:06:45,210 That way, everything that goes 197 197 00:06:45,210 --> 00:06:48,540 from your drive to my computer goes through this bridge. 198 198 00:06:48,540 --> 00:06:51,060 That allows me to read the data from your drive, 199 199 00:06:51,060 --> 00:06:54,330 but it blocks anything from going back onto your hard drive. 200 200 00:06:54,330 --> 00:06:57,000 This prevents me from changing anything on that hard disk, 201 201 00:06:57,000 --> 00:06:59,160 it becomes read only, essentially. 202 202 00:06:59,160 --> 00:07:01,860 This particular forensic bridge or write blocker 203 203 00:07:01,860 --> 00:07:03,840 is used whenever you're trying to access data 204 204 00:07:03,840 --> 00:07:06,600 off a hard drive onto a given workstation. 205 205 00:07:06,600 --> 00:07:08,850 But sometimes, you don't even need a workstation, 206 206 00:07:08,850 --> 00:07:10,080 if you're just trying to do imaging, 207 207 00:07:10,080 --> 00:07:11,850 which is what we're talking about here. 208 208 00:07:11,850 --> 00:07:12,683 And so for that, 209 209 00:07:12,683 --> 00:07:13,950 you can have dedicated machines 210 210 00:07:13,950 --> 00:07:15,630 that will do this imaging for you. 211 211 00:07:15,630 --> 00:07:18,420 You can have a forensic disk imager, like this one. 212 212 00:07:18,420 --> 00:07:20,010 Now again, this is made by Tableau, 213 213 00:07:20,010 --> 00:07:22,680 and Tableau is a very popular hardware manufacturer 214 214 00:07:22,680 --> 00:07:24,330 for the forensic market. 215 215 00:07:24,330 --> 00:07:26,760 Notice here, we have a hard drive that we're collecting on. 216 216 00:07:26,760 --> 00:07:28,500 We plug it in to our device, 217 217 00:07:28,500 --> 00:07:30,690 which then copies that and creates the image file 218 218 00:07:30,690 --> 00:07:34,950 for us bit-by-bit doing a physical acquisition of the drive 219 219 00:07:34,950 --> 00:07:36,960 using a static acquisition. 220 220 00:07:36,960 --> 00:07:37,800 Once it's done, 221 221 00:07:37,800 --> 00:07:39,870 that image file will be in this device, 222 222 00:07:39,870 --> 00:07:42,150 and we can then upload it to our forensic server, 223 223 00:07:42,150 --> 00:07:44,310 and then we can go through and do our analysis later on 224 224 00:07:44,310 --> 00:07:46,230 with our forensic workstation. 225 225 00:07:46,230 --> 00:07:49,590 Now, this brings us to the idea of imaging utilities. 226 226 00:07:49,590 --> 00:07:51,270 If I was going to use that forensic bridge, 227 227 00:07:51,270 --> 00:07:52,710 I need to have some kind of software 228 228 00:07:52,710 --> 00:07:54,480 to do the copying for me. 229 229 00:07:54,480 --> 00:07:57,090 I can't just use Windows copying and drag and drop files, 230 230 00:07:57,090 --> 00:08:00,000 it doesn't work, that's not a forensically sound image. 231 231 00:08:00,000 --> 00:08:01,890 So instead, we use imaging utilities, 232 232 00:08:01,890 --> 00:08:03,240 and this is a software utility 233 233 00:08:03,240 --> 00:08:06,240 that conducts the disk imaging of a given target. 234 234 00:08:06,240 --> 00:08:08,610 Now, many image acquisition softwares are out there, 235 235 00:08:08,610 --> 00:08:11,370 and they will also perform your cryptographic hashing 236 236 00:08:11,370 --> 00:08:13,260 of the data being acquired. 237 237 00:08:13,260 --> 00:08:14,190 Now, this is important 238 238 00:08:14,190 --> 00:08:16,380 because anytime you make a copy of something, 239 239 00:08:16,380 --> 00:08:17,213 we talked about the fact 240 240 00:08:17,213 --> 00:08:19,050 we need to make sure we have integrity 241 241 00:08:19,050 --> 00:08:20,520 and we know the status of it. 242 242 00:08:20,520 --> 00:08:23,580 So if I'm making a copy of a hard drive, for instance, 243 243 00:08:23,580 --> 00:08:26,040 I need to know what that hard drive's hash was, 244 244 00:08:26,040 --> 00:08:28,170 and then I now have the copy 245 245 00:08:28,170 --> 00:08:30,810 and make sure its hash matches that hard drive. 246 246 00:08:30,810 --> 00:08:32,010 If both of those match, 247 247 00:08:32,010 --> 00:08:33,780 that means the data is intact 248 248 00:08:33,780 --> 00:08:36,360 in the image and the hard drive itself 249 249 00:08:36,360 --> 00:08:37,680 and nothing's been changed. 250 250 00:08:37,680 --> 00:08:39,390 Now, this will be done automatically for you, 251 251 00:08:39,390 --> 00:08:41,490 if you're using something like FTK or EnCase, 252 252 00:08:41,490 --> 00:08:42,930 but if you're using something like dd, 253 253 00:08:42,930 --> 00:08:44,490 which we're going to talk about in a minute, 254 254 00:08:44,490 --> 00:08:46,800 you're going to have to do that hashing function yourself. 255 255 00:08:46,800 --> 00:08:48,480 So it is important to understand your tools 256 256 00:08:48,480 --> 00:08:50,970 and if they have this cryptographic hashing function. 257 257 00:08:50,970 --> 00:08:52,440 Now, when you acquire this data, 258 258 00:08:52,440 --> 00:08:54,660 it has to be stored in a file format, 259 259 00:08:54,660 --> 00:08:56,520 and there's different image acquisition tools 260 260 00:08:56,520 --> 00:08:58,290 that use different acquisition formats 261 261 00:08:58,290 --> 00:08:59,940 depending on what you're using. 262 262 00:08:59,940 --> 00:09:02,940 For instance, if you have .eO1, that's an EnCase file, 263 263 00:09:02,940 --> 00:09:04,770 and it's proprietary to their tool. 264 264 00:09:04,770 --> 00:09:08,070 If you have .aff, this is the advanced forensic format, 265 265 00:09:08,070 --> 00:09:10,950 and this is something commonly used by FTK Imager. 266 266 00:09:10,950 --> 00:09:11,970 And then we have dd, 267 267 00:09:11,970 --> 00:09:13,620 which is an industry standard one 268 268 00:09:13,620 --> 00:09:15,210 that is used across the board. 269 269 00:09:15,210 --> 00:09:16,470 It's an open source format, 270 270 00:09:16,470 --> 00:09:18,360 and it's been around for decades. 271 271 00:09:18,360 --> 00:09:20,670 DD is a disk duplication file, 272 272 00:09:20,670 --> 00:09:21,930 and it is a standard image 273 273 00:09:21,930 --> 00:09:23,850 that all tools can pretty much read. 274 274 00:09:23,850 --> 00:09:25,500 So when you choose your tool, 275 275 00:09:25,500 --> 00:09:27,240 you can decide what format you're going to use. 276 276 00:09:27,240 --> 00:09:30,330 For instance, EnCase supports eO1 and dd. 277 277 00:09:30,330 --> 00:09:32,790 FTK supports aff and dd, 278 278 00:09:32,790 --> 00:09:35,490 and so dd works on pretty much every tool out there. 279 279 00:09:35,490 --> 00:09:38,730 EO1 and aff work in some tools, but not all tools, 280 280 00:09:38,730 --> 00:09:39,930 so depending on your tool, 281 281 00:09:39,930 --> 00:09:42,030 you'll figure out what format you want to use. 282 282 00:09:42,030 --> 00:09:45,600 Now, the reason why some people use eO1 or aff over dd 283 283 00:09:45,600 --> 00:09:48,060 is those formats can actually store metadata as well, 284 284 00:09:48,060 --> 00:09:50,760 like the hash and other things about your case, 285 285 00:09:50,760 --> 00:09:53,550 and so, a lot of people like that newer format. 286 286 00:09:53,550 --> 00:09:55,350 Speaking of dd, what is that? 287 287 00:09:55,350 --> 00:09:59,550 Well, it's a command line tool for Unix, Linux, and macOS, 288 288 00:09:59,550 --> 00:10:02,130 and this can perform disk image acquisition. 289 289 00:10:02,130 --> 00:10:04,950 Basically, think about it as the disk duplicator. 290 290 00:10:04,950 --> 00:10:06,930 That's the idea of dd. 291 291 00:10:06,930 --> 00:10:08,190 Now, when you use dd, 292 292 00:10:08,190 --> 00:10:10,980 you're going to provide it using a command line syntax. 293 293 00:10:10,980 --> 00:10:14,280 You're going to have the command itself, dd, and then if=, 294 294 00:10:14,280 --> 00:10:17,460 which is input file, and then the path to the input file. 295 295 00:10:17,460 --> 00:10:20,610 Now, in this case, the input file is actually a hard drive. 296 296 00:10:20,610 --> 00:10:23,820 It's /dev, for device, /sda, 297 297 00:10:23,820 --> 00:10:26,580 which is the first hard drive on this system. 298 298 00:10:26,580 --> 00:10:28,853 Then I have the output file, of=, 299 299 00:10:29,910 --> 00:10:31,844 and then, where am I going to put it? 300 300 00:10:31,844 --> 00:10:35,910 /mnt/flashdrive/evidence.dd. 301 301 00:10:35,910 --> 00:10:38,580 And notice, I'm using the dd file format here. 302 302 00:10:38,580 --> 00:10:39,450 Now alternatively, 303 303 00:10:39,450 --> 00:10:41,160 if I wanted to take data from an image file 304 304 00:10:41,160 --> 00:10:42,600 and put it onto a hard drive, 305 305 00:10:42,600 --> 00:10:44,670 so that I can actually run it off the hard drive, 306 306 00:10:44,670 --> 00:10:46,050 I can just swap these around, 307 307 00:10:46,050 --> 00:10:51,050 and I can go dd input file =/mnt/flashdrive/evidence.dd, 308 308 00:10:52,080 --> 00:10:53,612 that image file, 309 309 00:10:53,612 --> 00:10:58,230 of=/dev/ whatever you're going to put it to, sda, for instance. 310 310 00:10:58,230 --> 00:10:59,490 And so, that's the way dd works. 311 311 00:10:59,490 --> 00:11:01,200 It can take anything as an input and output. 312 312 00:11:01,200 --> 00:11:03,630 It can go file to file, device to device, 313 313 00:11:03,630 --> 00:11:06,420 device to file, or file to device. 314 314 00:11:06,420 --> 00:11:08,700 Now, if you're acquiring a virtual hard drive 315 315 00:11:08,700 --> 00:11:09,533 because you're dealing with 316 316 00:11:09,533 --> 00:11:12,240 some kind of a virtualized server or a virtual machine, 317 317 00:11:12,240 --> 00:11:14,490 remember, those files for those servers 318 318 00:11:14,490 --> 00:11:17,640 are already stored in a virtual image format. 319 319 00:11:17,640 --> 00:11:20,760 If you're using Vmware, it's going to be vmdk files. 320 320 00:11:20,760 --> 00:11:24,300 If you're using Hyper-V, it's vhd or vhdx. 321 321 00:11:24,300 --> 00:11:27,300 If you're using VirtualBox, it's going to be vdi. 322 322 00:11:27,300 --> 00:11:29,670 All of these are formats that could be used 323 323 00:11:29,670 --> 00:11:31,260 depending on which tool they're using 324 324 00:11:31,260 --> 00:11:33,060 for their virtualization solution. 325 325 00:11:33,060 --> 00:11:35,070 So if you come across a virtualized server 326 326 00:11:35,070 --> 00:11:37,020 that's being hosted by a hypervisor, 327 327 00:11:37,020 --> 00:11:39,630 you can go in there and just collect that one image file 328 328 00:11:39,630 --> 00:11:40,770 and have everything you need 329 329 00:11:40,770 --> 00:11:43,110 for a forensically sound image right there. 330 330 00:11:43,110 --> 00:11:45,540 Just take a hash of it before you copy it off the machine, 331 331 00:11:45,540 --> 00:11:47,520 take a hash of it again once you acquire it, 332 332 00:11:47,520 --> 00:11:48,780 and make sure they match, 333 333 00:11:48,780 --> 00:11:51,580 and you have a forensically sound forensic image for it.