0Pricing
Cyber Security Academy · Lesson

Disk Imaging and File System Analysis

Recovering artifacts from storage.

Disk Imaging and File System Analysis is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Bit-for-Bit Imaging

A forensic image is a bit-for-bit copy of a storage device, including slack space, unallocated areas, and deleted-file remnants. A simple file copy misses all of this.

Two common formats:

  • Raw (dd / .img): identical bytes, no metadata, large
  • Expert Witness Format (E01): compressed, with embedded hashes and case metadata

Acquiring with dd and dcfldd

Classic raw acquisition uses dd, but forensic variants like dcfldd or dc3dd add inline hashing and progress.

Always image through a write blocker and hash before and after.

# Forensic raw image with inline hashing and verification
dcfldd if=/dev/sdb of=evidence.dd \
  hash=sha256 hashlog=evidence.hashlog \
  bs=4M conv=sync,noerror

# Verify the image matches the source
sha256sum /dev/sdb evidence.dd

The E01 Format

EnCase E01 images self-document. Tools like ewfacquire create them with embedded case data and built-in integrity verification.

E01 stores its own hash, so ewfverify can confirm the image has not been corrupted without an external log.

# Acquire to E01 with libewf
ewfacquire /dev/sdb \
  -t /cases/0042/evidence \
  -d sha256 -c best

# Verify integrity later
ewfverify /cases/0042/evidence.E01

File System Layout

To find artifacts you must understand the file system. Each tracks files differently:

  • NTFS: Master File Table (MFT), $LogFile, alternate data streams
  • ext4: inodes, journal, superblock
  • APFS: snapshots, copy-on-write
  • FAT/exFAT: directory entries, FAT chains

Metadata structures often retain references to deleted files long after deletion.

Slack Space and Unallocated Space

Two rich artifact sources:

  • Slack space: the gap between a file end and its allocated cluster end, which may hold fragments of older data
  • Unallocated space: clusters marked free but not yet overwritten, holding deleted-file content

Deleting a file usually just removes its directory pointer. The data persists until overwritten, which is what makes recovery possible.

The Sleuth Kit

The Sleuth Kit (TSK) is a command-line forensic suite for parsing file systems from an image.

  • mmls: partition layout
  • fls: list files including deleted
  • icat: extract a file by inode
  • istat: inode metadata
# Show partition table
mmls evidence.dd

# List files (deleted entries marked with *) in a partition at offset 2048
fls -r -o 2048 evidence.dd

# Recover a deleted file by inode number
icat -o 2048 evidence.dd 14593 > recovered.docx

File Carving

When file-system metadata is gone, carving recovers files by recognizing their headers and footers (magic bytes) directly from raw bytes.

Example: JPEG starts with FF D8 FF and ends with FF D9. Tools like scalpel, foremost, and photorec scan unallocated space for these signatures.

# Carve files from unallocated space by signature
foremost -t jpg,pdf,doc -i evidence.dd -o carved/

# photorec for broad recovery
photorec evidence.dd

Timestamps: MACB

File timestamps are core artifacts. NTFS and many systems track MACB:

  • Modified: content last changed
  • Accessed: last read
  • Changed: MFT/metadata changed
  • Born: creation time

Inconsistencies (e.g., a file created after it was modified) can reveal timestomping, an anti-forensic tactic.

Registry and System Artifacts

On Windows, the registry is a forensic goldmine. Offline hives extracted from an image reveal user activity:

  • SYSTEM: services, USB devices, time zone
  • NTUSER.DAT: recent files, run commands, typed paths
  • SAM: local account data
  • Shimcache / Amcache: program execution evidence
# Parse an offline registry hive with RegRipper
rip.pl -r SYSTEM -f system > system_report.txt

# Pull USB device history
rip.pl -r SYSTEM -p usbstor

Autopsy for Triage

Autopsy is a GUI front end to TSK that automates much of the workflow: keyword search, hash-set matching, web history, deleted-file recovery, and timeline generation across a whole image.

It is ideal for triage and for analysts who need an auditable, repeatable case structure, while raw TSK gives deeper control for edge cases.

Hash Sets and Known Files

To cut through millions of files, examiners use hash sets. The NIST NSRL lists hashes of known good software, so you can filter those out and focus on unknown or suspicious files.

Conversely, threat-intel hash sets flag known-bad files instantly. Matching a carved binary against a malware hash set immediately confirms a compromise.

# Build a hash list of all files and compare against a known-bad set
md5deep -r /mnt/evidence > all_hashes.txt
grep -F -f known_bad_md5.txt all_hashes.txt

Quick Check

Test your grasp of recovery techniques.

Recap

You learned how to image and analyze storage:

  • Bit-for-bit images (raw / E01) capture everything, including slack and unallocated space
  • The Sleuth Kit parses file systems and recovers deleted files by inode
  • Carving recovers data when metadata is destroyed
  • MACB timestamps and registry hives reconstruct user activity
  • Autopsy automates triage

Next: reconstructing attacks from network traffic.

Frequently asked questions

Is the “Disk Imaging and File System Analysis” lesson free?

Yes — the full text of “Disk Imaging and File System Analysis” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Disk Imaging and File System Analysis”?

Recovering artifacts from storage. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Disk Imaging and File System Analysis” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Forensic Fundamentals and Chain of Custody
  2. Disk Imaging and File System Analysis
  3. Network Forensics with PCAP
  4. Timeline Analysis and Reporting
← Back to Cyber Security Academy