1 00:00:00,120 --> 00:00:00,953 In this lesson, 2 00:00:00,953 --> 00:00:03,780 I'm going to show you how to create a disk image 3 00:00:03,780 --> 00:00:07,650 from a USB thumb drive using DD in Linux, Unix 4 00:00:07,650 --> 00:00:09,720 or Macintosh system. 5 00:00:09,720 --> 00:00:11,190 So the first thing you need to do 6 00:00:11,190 --> 00:00:15,330 is connect your USB thumbs stick through a write blocker. 7 00:00:15,330 --> 00:00:18,000 Now, if you don't have a write blocker for the purposes 8 00:00:18,000 --> 00:00:20,038 of this lab, you don't really need one 9 00:00:20,038 --> 00:00:23,910 because again, we're not doing a forensic image necessarily 10 00:00:23,910 --> 00:00:25,230 because we're not law enforcement. 11 00:00:25,230 --> 00:00:26,520 But if you are working in the field, 12 00:00:26,520 --> 00:00:28,200 you really do want to use a write blocker. 13 00:00:28,200 --> 00:00:30,060 So I'm going to plug it into my machine 14 00:00:30,060 --> 00:00:34,290 and I'm going to use fdisk -l to list the devices that I have. 15 00:00:34,290 --> 00:00:36,630 You can see I have an internal hard drive 16 00:00:36,630 --> 00:00:38,730 of eight gigabytes in size. 17 00:00:38,730 --> 00:00:40,620 I have this virtual hard disk 18 00:00:40,620 --> 00:00:42,000 of two and a half gigabytes in size. 19 00:00:42,000 --> 00:00:44,610 And then this is my two gigabyte thumbs stick 20 00:00:44,610 --> 00:00:45,840 that I'm looking for. 21 00:00:45,840 --> 00:00:49,350 S-D-B, SDB is the device name 22 00:00:49,350 --> 00:00:53,430 and it does have one partition on it that is 1.9 gigabytes 23 00:00:53,430 --> 00:00:57,600 in size and it is a FAT32 for Windows type partition. 24 00:00:57,600 --> 00:00:59,850 So to create the disk image, 25 00:00:59,850 --> 00:01:03,780 what I'm going to do is do DD and then block size 26 00:01:03,780 --> 00:01:05,910 of 64 kilobytes. 27 00:01:05,910 --> 00:01:09,150 My input file is whatever that disk is. 28 00:01:09,150 --> 00:01:11,880 Now, this is where you have to decide what you want to copy. 29 00:01:11,880 --> 00:01:16,290 Do I want to copy the entire disk or just the one partition? 30 00:01:16,290 --> 00:01:19,470 Now, in my case, I do want the entire disk. 31 00:01:19,470 --> 00:01:20,460 And the reason why is 32 00:01:20,460 --> 00:01:22,410 because I want everything that is partitioned 33 00:01:22,410 --> 00:01:24,630 and everything that's not partitioned. 34 00:01:24,630 --> 00:01:27,660 So if I'm going through and I'm a legal investigator 35 00:01:27,660 --> 00:01:29,250 and I'm looking for hidden things, 36 00:01:29,250 --> 00:01:31,830 sometimes those exist outside the partition. 37 00:01:31,830 --> 00:01:36,330 So by doing the /sdb, I get the entire disk drive, 38 00:01:36,330 --> 00:01:39,090 all of the partitions and any of the blank space. 39 00:01:39,090 --> 00:01:40,500 And then the output file, 40 00:01:40,500 --> 00:01:44,820 which in my case I'm just going to call it usd2gb.dd 41 00:01:44,820 --> 00:01:47,820 and hit enter and it will start copying that drive. 42 00:01:47,820 --> 00:01:50,790 This will usually take about 30 seconds 43 00:01:50,790 --> 00:01:52,980 for every gigabyte you're going to copy 44 00:01:52,980 --> 00:01:54,660 depending on your system speed. 45 00:01:54,660 --> 00:01:55,830 So I'm going to go ahead and fast forward 46 00:01:55,830 --> 00:01:59,790 to the end of this copy and we'll pick it up from there. 47 00:01:59,790 --> 00:02:02,400 All right, we're back and the disk has finished copying 48 00:02:02,400 --> 00:02:04,410 and we can see that here in the directory, 49 00:02:04,410 --> 00:02:08,729 usd2gb.dd is the file. 50 00:02:08,729 --> 00:02:11,490 So what I want to do at this point is create a hash 51 00:02:11,490 --> 00:02:14,910 because again, that chain of custody is very important. 52 00:02:14,910 --> 00:02:18,480 And the way to do that in Linux is just doing md5sum, 53 00:02:18,480 --> 00:02:21,120 which is an MD5 hash, and then the file name, 54 00:02:21,120 --> 00:02:25,980 in our case usb2gb.dd and hit Enter. 55 00:02:25,980 --> 00:02:28,219 It will calculate how that hash will be 56 00:02:28,219 --> 00:02:30,630 and output it there on the screen. 57 00:02:30,630 --> 00:02:31,920 At that point, I would enter that 58 00:02:31,920 --> 00:02:35,400 into my log and that becomes part of the chain of custody. 59 00:02:35,400 --> 00:02:38,700 I would also want to use a SHA-1 or a SHA-256 60 00:02:38,700 --> 00:02:41,130 because MD5 is considered a little bit weak 61 00:02:41,130 --> 00:02:42,630 in this day and age. 62 00:02:42,630 --> 00:02:45,183 Now, first thing you're going to do is download 63 00:02:45,183 --> 00:02:46,016 and install the FTK Imager. 64 00:02:46,016 --> 00:02:48,510 Once you have that done, you'll go ahead and open it. 65 00:02:48,510 --> 00:02:50,700 You will have to give it administrative permission 66 00:02:50,700 --> 00:02:53,490 as I did just there and it will open up the program. 67 00:02:53,490 --> 00:02:56,640 Now FTK Imager does allow you to do some a bit 68 00:02:56,640 --> 00:02:58,380 of looking through the files, 69 00:02:58,380 --> 00:02:59,213 but in this case, 70 00:02:59,213 --> 00:03:01,410 we're going to first look at collecting the image 71 00:03:01,410 --> 00:03:03,000 for a forensic image. 72 00:03:03,000 --> 00:03:04,770 So you're going to go to File 73 00:03:04,770 --> 00:03:07,410 and then go down to Create Disk Image. 74 00:03:07,410 --> 00:03:09,420 Then you'll select whether it's a physical drive 75 00:03:09,420 --> 00:03:11,371 a logical drive, an image file 76 00:03:11,371 --> 00:03:15,870 the contents of a folder or multiple CDs and DVDs. 77 00:03:15,870 --> 00:03:17,820 In my case, it is a physical drive 78 00:03:17,820 --> 00:03:21,090 because it's a USB thumb drive and I'll click Next 79 00:03:21,090 --> 00:03:22,770 and then I'm going to select the drive. 80 00:03:22,770 --> 00:03:24,723 And in my case, it is physical drive one 81 00:03:24,723 --> 00:03:27,750 it's a Memorex, two gigabyte USB thumbs stick 82 00:03:27,750 --> 00:03:29,580 and I'll hit Finish. 83 00:03:29,580 --> 00:03:32,340 At this point, it'll ask where do I want to save the file 84 00:03:32,340 --> 00:03:33,600 that I'm going to create? 85 00:03:33,600 --> 00:03:35,100 So I'm going to go ahead and do it 86 00:03:35,100 --> 00:03:39,540 as a raw DD image because any forensic tool can use that, 87 00:03:39,540 --> 00:03:42,360 whereas EO1 is reserved for EnCase 88 00:03:42,360 --> 00:03:46,650 and AFF is reserved for FTK, then select Next. 89 00:03:46,650 --> 00:03:48,480 You can give it the information you want. 90 00:03:48,480 --> 00:03:49,313 In my case, 91 00:03:49,313 --> 00:03:52,950 I'm just going to call this case zero one, evidence number, 92 00:03:52,950 --> 00:03:56,843 We'll call that zero one, unique description, USB 2GB drive. 93 00:03:59,040 --> 00:04:01,890 The examiner was my name, Jason Dion 94 00:04:01,890 --> 00:04:05,160 and any notes you may have, then click Next. 95 00:04:05,160 --> 00:04:07,140 Select where you want it to be stored. 96 00:04:07,140 --> 00:04:08,940 In my case, I'm just going to save it directly 97 00:04:08,940 --> 00:04:11,160 to my desktop so I can find it easily. 98 00:04:11,160 --> 00:04:13,110 And then what is the file name going to be called? 99 00:04:13,110 --> 00:04:18,110 I'm going to call USB2GB.dd for the DD image 100 00:04:20,220 --> 00:04:23,880 and then I will hit finish and I will start. 101 00:04:23,880 --> 00:04:25,770 And when I'm done, it's going to verify images 102 00:04:25,770 --> 00:04:28,920 after they're created, which will create the hash for me. 103 00:04:28,920 --> 00:04:32,220 And we will go ahead and hit Start and off it will go. 104 00:04:32,220 --> 00:04:33,600 Now, this will take a couple of minutes 105 00:04:33,600 --> 00:04:36,060 because it is a two gigabyte thumbs stick 106 00:04:36,060 --> 00:04:38,670 and two gigabytes is quite a bit of data to be imaging. 107 00:04:38,670 --> 00:04:41,970 So it'll probably take us about five minutes. 108 00:04:41,970 --> 00:04:43,410 So I will speed up the video 109 00:04:43,410 --> 00:04:45,570 so you don't have to see and watch it count for five minutes 110 00:04:45,570 --> 00:04:47,873 and then I'll come back and we'll talk about it. 111 00:04:53,850 --> 00:04:56,220 So as you can see, it took about two minutes for it 112 00:04:56,220 --> 00:04:58,680 to copy the two gigabyte drive. 113 00:04:58,680 --> 00:05:00,420 And now it's going through and doing a verification 114 00:05:00,420 --> 00:05:02,250 which is creating the hash. 115 00:05:02,250 --> 00:05:04,653 This is going to take us maybe about 20 seconds, 116 00:05:05,580 --> 00:05:08,490 and as soon as it's done, we get our drive results. 117 00:05:08,490 --> 00:05:10,230 So let's scroll up here and we can look at this. 118 00:05:10,230 --> 00:05:12,445 So you'll have the name of the drive, 119 00:05:12,445 --> 00:05:15,810 which in my case is USB2GB.dd. 001, 120 00:05:15,810 --> 00:05:18,660 which is the first file, the sector count 121 00:05:18,660 --> 00:05:19,980 that's going to be involved. 122 00:05:19,980 --> 00:05:22,080 You'll see the hash, the reported hash 123 00:05:22,080 --> 00:05:23,340 and the computed hash 124 00:05:23,340 --> 00:05:24,390 and they both match 125 00:05:24,390 --> 00:05:26,790 and they should because that's what we just did. 126 00:05:26,790 --> 00:05:29,460 And then it'll also give you a SHA-1 computed hash 127 00:05:29,460 --> 00:05:30,780 and reported hash, 128 00:05:30,780 --> 00:05:33,090 and there were no bad blocks in the image. 129 00:05:33,090 --> 00:05:34,800 So we can go ahead and hit Close, 130 00:05:34,800 --> 00:05:37,350 and then we can hit Close again. 131 00:05:37,350 --> 00:05:38,700 Now, let me minimize this, 132 00:05:38,700 --> 00:05:41,070 and you'll be able to see the disk image. 133 00:05:41,070 --> 00:05:43,560 It is going to sit here inside the Jason Dion folder 134 00:05:43,560 --> 00:05:46,200 which is my administrative account and on the desktop. 135 00:05:46,200 --> 00:05:48,720 You'll see that there are a couple of files here. 136 00:05:48,720 --> 00:05:53,070 There is 001 and 002, now what is the difference? 137 00:05:53,070 --> 00:05:53,903 Well, if you'll notice, 138 00:05:53,903 --> 00:05:56,580 this is only a 1.5 gigabyte image, 139 00:05:56,580 --> 00:05:57,930 that's where the software 140 00:05:57,930 --> 00:06:00,060 by default is going to break these into chunks. 141 00:06:00,060 --> 00:06:02,370 So if you have a one terabyte hard drive, 142 00:06:02,370 --> 00:06:04,620 every 1.5 gigabytes or so, 143 00:06:04,620 --> 00:06:07,140 it's going to chunk that into a separate file. 144 00:06:07,140 --> 00:06:09,660 That's okay because it's going to be able to read that 145 00:06:09,660 --> 00:06:11,520 as I bring that back into the software. 146 00:06:11,520 --> 00:06:13,170 And then you'll see this text file 147 00:06:13,170 --> 00:06:15,720 which is just going to have the summary contents for us. 148 00:06:15,720 --> 00:06:17,757 So it tells us it was created by FTK 149 00:06:17,757 --> 00:06:19,500 and this is part of our chain of custody. 150 00:06:19,500 --> 00:06:21,930 Now, it's going to tell us what the drive looked like, 151 00:06:21,930 --> 00:06:23,520 it's going to tell us what the device looked 152 00:06:23,520 --> 00:06:24,960 like and its serial number 153 00:06:24,960 --> 00:06:26,880 and it's going to give us the computed hashes 154 00:06:26,880 --> 00:06:29,070 and the reported hashes that we did, 155 00:06:29,070 --> 00:06:31,080 as well as our verified hashes. 156 00:06:31,080 --> 00:06:33,720 So this was a hash before we took the image 157 00:06:33,720 --> 00:06:36,780 and this is the hash after we copy the image. 158 00:06:36,780 --> 00:06:39,060 Now, if you want to open this file, 159 00:06:39,060 --> 00:06:42,540 we're going to do that inside of FTK and we can analyze it. 160 00:06:42,540 --> 00:06:45,720 So we'll do File, we'll add evidence item. 161 00:06:45,720 --> 00:06:47,790 It's going to be an image file this time 162 00:06:47,790 --> 00:06:49,350 'cause we just created the image, 163 00:06:49,350 --> 00:06:50,850 and then we're going to find it 164 00:06:50,850 --> 00:06:53,910 and it is sitting inside my Jason Dion folder 165 00:06:53,910 --> 00:06:57,750 on the desktop and you'll open up the first one, 001 166 00:06:57,750 --> 00:07:00,900 and it'll open 001 and 002 for me. 167 00:07:00,900 --> 00:07:03,870 The drive shows up here in the evidence tree. 168 00:07:03,870 --> 00:07:05,550 Now, as you open it, 169 00:07:05,550 --> 00:07:08,700 you'll see the partitioned and the unpartitioned space. 170 00:07:08,700 --> 00:07:10,950 So any files that may have been hidden, 171 00:07:10,950 --> 00:07:14,010 would show up in this unallocated space. 172 00:07:14,010 --> 00:07:17,340 Now, if I open up the drive itself, it was FAT32 173 00:07:17,340 --> 00:07:20,010 and I can look at the root of the drive 174 00:07:20,010 --> 00:07:22,830 and you'll see the different types of files on it. 175 00:07:22,830 --> 00:07:25,269 Notice the ones with the Xs here, this.mp3. 176 00:07:25,269 --> 00:07:28,770 This is a deleted file, but I can see it 177 00:07:28,770 --> 00:07:31,200 because of this forensic techniques that we're using. 178 00:07:31,200 --> 00:07:32,250 And you can see all sorts 179 00:07:32,250 --> 00:07:34,449 of different music that I used to have 180 00:07:34,449 --> 00:07:36,480 on this thumb drive that have been deleted at some point. 181 00:07:36,480 --> 00:07:38,220 And some of these files can be restored 182 00:07:38,220 --> 00:07:40,530 using this forensic software. 183 00:07:40,530 --> 00:07:42,270 The other thing we're going to be looking for here 184 00:07:42,270 --> 00:07:45,480 is we can scroll down and see anything that's deleted. 185 00:07:45,480 --> 00:07:47,280 You can see all of those files 186 00:07:47,280 --> 00:07:49,470 and you'll be able to see the ones that are not deleted. 187 00:07:49,470 --> 00:07:51,210 So let's look at the date modified. 188 00:07:51,210 --> 00:07:54,780 What was the most recently touched things on the system? 189 00:07:54,780 --> 00:07:56,273 Well, this deleted folder was 190 00:07:56,273 --> 00:07:59,667 so maybe the bad guy was trying to hide something from us. 191 00:07:59,667 --> 00:08:00,960 And so I can actually go in 192 00:08:00,960 --> 00:08:03,390 and restore that and look at that. 193 00:08:03,390 --> 00:08:05,850 Then you can see these other files that are sitting here. 194 00:08:05,850 --> 00:08:07,410 Again, these are in the slack space 195 00:08:07,410 --> 00:08:10,560 because they were deleted a long time ago. 196 00:08:10,560 --> 00:08:12,600 Now, this again, is not a forensics course 197 00:08:12,600 --> 00:08:14,580 where I'm going to teach you everything how to do this. 198 00:08:14,580 --> 00:08:15,413 I just want to show you some 199 00:08:15,413 --> 00:08:17,100 of the capabilities that you can go back 200 00:08:17,100 --> 00:08:19,080 and pull some of this information. 201 00:08:19,080 --> 00:08:21,510 So if we open this, we can see inside this folder, 202 00:08:21,510 --> 00:08:23,640 there was all of these different slides. 203 00:08:23,640 --> 00:08:25,740 And so maybe if I open this slide, oh look, 204 00:08:25,740 --> 00:08:29,010 we can find this deleted folder and see what it looked like. 205 00:08:29,010 --> 00:08:32,789 It looked like an in brief for some sort of operation. 206 00:08:32,789 --> 00:08:34,080 Now what is this really? 207 00:08:34,080 --> 00:08:36,030 Well, this was something I did for my church. 208 00:08:36,030 --> 00:08:38,100 We did a Spy Night for the kids 209 00:08:38,100 --> 00:08:39,419 and these are some old files 210 00:08:39,419 --> 00:08:42,120 from that Spy Night folder that we used. 211 00:08:42,120 --> 00:08:43,140 But that's the idea here, 212 00:08:43,140 --> 00:08:46,830 is that you can go back and restore some of these things 213 00:08:46,830 --> 00:08:49,290 and be able to see what the bad guy was trying to hide 214 00:08:49,290 --> 00:08:51,240 as you go through and do the analysis 215 00:08:51,240 --> 00:08:52,500 that's the benefit of this. 216 00:08:52,500 --> 00:08:54,420 And we're doing this off the disk image 217 00:08:54,420 --> 00:08:56,160 not the drive we originally collected 218 00:08:56,160 --> 00:08:58,080 because that USB drive is not even plugged 219 00:08:58,080 --> 00:09:00,580 into the computer anymore 'cause we don't need it.