In this lesson,
I'm going to show you how to create a disk image
from a USB thumb drive using DD in Linux, Unix
or Macintosh system.
So the first thing you need to do
is connect your USB thumbs stick through a write blocker.
Now, if you don't have a write blocker for the purposes
of this lab, you don't really need one
because again, we're not doing a forensic image necessarily
because we're not law enforcement.
But if you are working in the field,
you really do want to use a write blocker.
So I'm going to plug it into my machine
and I'm going to use fdisk -l to list the devices that I have.
You can see I have an internal hard drive
of eight gigabytes in size.
I have this virtual hard disk
of two and a half gigabytes in size.
And then this is my two gigabyte thumbs stick
that I'm looking for.
S-D-B, SDB is the device name
and it does have one partition on it that is 1.9 gigabytes
in size and it is a FAT32 for Windows type partition.
So to create the disk image,
what I'm going to do is do DD and then block size
of 64 kilobytes.
My input file is whatever that disk is.
Now, this is where you have to decide what you want to copy.
Do I want to copy the entire disk or just the one partition?
Now, in my case, I do want the entire disk.
And the reason why is
because I want everything that is partitioned
and everything that's not partitioned.
So if I'm going through and I'm a legal investigator
and I'm looking for hidden things,
sometimes those exist outside the partition.
So by doing the /sdb, I get the entire disk drive,
all of the partitions and any of the blank space.
And then the output file,
which in my case I'm just going to call it usd2gb.dd
and hit enter and it will start copying that drive.
This will usually take about 30 seconds
for every gigabyte you're going to copy
depending on your system speed.
So I'm going to go ahead and fast forward
to the end of this copy and we'll pick it up from there.
All right, we're back and the disk has finished copying
and we can see that here in the directory,
usd2gb.dd is the file.
So what I want to do at this point is create a hash
because again, that chain of custody is very important.
And the way to do that in Linux is just doing md5sum,
which is an MD5 hash, and then the file name,
in our case usb2gb.dd and hit Enter.
It will calculate how that hash will be
and output it there on the screen.
At that point, I would enter that
into my log and that becomes part of the chain of custody.
I would also want to use a SHA-1 or a SHA-256
because MD5 is considered a little bit weak
in this day and age.
Now, first thing you're going to do is download
and install the FTK Imager.
Once you have that done, you'll go ahead and open it.
You will have to give it administrative permission
as I did just there and it will open up the program.
Now FTK Imager does allow you to do some a bit
of looking through the files,
but in this case,
we're going to first look at collecting the image
for a forensic image.
So you're going to go to File
and then go down to Create Disk Image.
Then you'll select whether it's a physical drive
a logical drive, an image file
the contents of a folder or multiple CDs and DVDs.
In my case, it is a physical drive
because it's a USB thumb drive and I'll click Next
and then I'm going to select the drive.
And in my case, it is physical drive one
it's a Memorex, two gigabyte USB thumbs stick
and I'll hit Finish.
At this point, it'll ask where do I want to save the file
that I'm going to create?
So I'm going to go ahead and do it
as a raw DD image because any forensic tool can use that,
whereas EO1 is reserved for EnCase
and AFF is reserved for FTK, then select Next.
You can give it the information you want.
In my case,
I'm just going to call this case zero one, evidence number,
We'll call that zero one, unique description, USB 2GB drive.
The examiner was my name, Jason Dion
and any notes you may have, then click Next.
Select where you want it to be stored.
In my case, I'm just going to save it directly
to my desktop so I can find it easily.
And then what is the file name going to be called?
I'm going to call USB2GB.dd for the DD image
and then I will hit finish and I will start.
And when I'm done, it's going to verify images
after they're created, which will create the hash for me.
And we will go ahead and hit Start and off it will go.
Now, this will take a couple of minutes
because it is a two gigabyte thumbs stick
and two gigabytes is quite a bit of data to be imaging.
So it'll probably take us about five minutes.
So I will speed up the video
so you don't have to see and watch it count for five minutes
and then I'll come back and we'll talk about it.
So as you can see, it took about two minutes for it
to copy the two gigabyte drive.
And now it's going through and doing a verification
which is creating the hash.
This is going to take us maybe about 20 seconds,
and as soon as it's done, we get our drive results.
So let's scroll up here and we can look at this.
So you'll have the name of the drive,
which in my case is USB2GB.dd. 001,
which is the first file, the sector count
that's going to be involved.
You'll see the hash, the reported hash
and the computed hash
and they both match
and they should because that's what we just did.
And then it'll also give you a SHA-1 computed hash
and reported hash,
and there were no bad blocks in the image.
So we can go ahead and hit Close,
and then we can hit Close again.
Now, let me minimize this,
and you'll be able to see the disk image.
It is going to sit here inside the Jason Dion folder
which is my administrative account and on the desktop.
You'll see that there are a couple of files here.
There is 001 and 002, now what is the difference?
Well, if you'll notice,
this is only a 1.5 gigabyte image,
that's where the software
by default is going to break these into chunks.
So if you have a one terabyte hard drive,
every 1.5 gigabytes or so,
it's going to chunk that into a separate file.
That's okay because it's going to be able to read that
as I bring that back into the software.
And then you'll see this text file
which is just going to have the summary contents for us.
So it tells us it was created by FTK
and this is part of our chain of custody.
Now, it's going to tell us what the drive looked like,
it's going to tell us what the device looked
like and its serial number
and it's going to give us the computed hashes
and the reported hashes that we did,
as well as our verified hashes.
So this was a hash before we took the image
and this is the hash after we copy the image.
Now, if you want to open this file,
we're going to do that inside of FTK and we can analyze it.
So we'll do File, we'll add evidence item.
It's going to be an image file this time
'cause we just created the image,
and then we're going to find it
and it is sitting inside my Jason Dion folder
on the desktop and you'll open up the first one, 001
and it'll open 001 and 002 for me.
The drive shows up here in the evidence tree.
Now, as you open it,
you'll see the partitioned and the unpartitioned space.
So any files that may have been hidden,
would show up in this unallocated space.
Now, if I open up the drive itself, it was FAT32
and I can look at the root of the drive
and you'll see the different types of files on it.
Notice the ones with the Xs here, this.mp3.
This is a deleted file, but I can see it
because of this forensic techniques that we're using.
And you can see all sorts
of different music that I used to have
on this thumb drive that have been deleted at some point.
And some of these files can be restored
using this forensic software.
The other thing we're going to be looking for here
is we can scroll down and see anything that's deleted.
You can see all of those files
and you'll be able to see the ones that are not deleted.
So let's look at the date modified.
What was the most recently touched things on the system?
Well, this deleted folder was
so maybe the bad guy was trying to hide something from us.
And so I can actually go in
and restore that and look at that.
Then you can see these other files that are sitting here.
Again, these are in the slack space
because they were deleted a long time ago.
Now, this again, is not a forensics course
where I'm going to teach you everything how to do this.
I just want to show you some
of the capabilities that you can go back
and pull some of this information.
So if we open this, we can see inside this folder,
there was all of these different slides.
And so maybe if I open this slide, oh look,
we can find this deleted folder and see what it looked like.
It looked like an in brief for some sort of operation.
Now what is this really?
Well, this was something I did for my church.
We did a Spy Night for the kids
and these are some old files
from that Spy Night folder that we used.
But that's the idea here,
is that you can go back and restore some of these things
and be able to see what the bad guy was trying to hide
as you go through and do the analysis
that's the benefit of this.
And we're doing this off the disk image
not the drive we originally collected
because that USB drive is not even plugged
into the computer anymore 'cause we don't need it.