Disk Imaging and File System Forensics

Forensic imaging creates a bit-for-bit copy of storage media while preserving evidence integrity. The original evidence must never be modified — work from a write-blocked copy. Hash the original and copy to verify exact reproduction.

Hardware write blockers physically prevent write commands from reaching evidence drives. Software write blockers (dc3dd, FTK Imager) prevent OS-level writes. Always use a write blocker before connecting evidence drives to prevent accidental evidence modification.

dd creates raw disk images. dc3dd adds progress reporting, hashing, and split output — essential for large drives. Use bs=4096 for performance. Verify the image hash matches the evidence hash to demonstrate integrity.

FTK Imager provides a GUI for Windows disk imaging. It supports E01 (Expert Witness Format) which compresses the image and stores the hash, acquisition details, and examiner notes in the file header — the forensic standard for evidence.

FAT32 stores file metadata in directory entries and allocation chain in the File Allocation Table. Deleted files leave directory entries with a 0xE5 marker; the FAT chain is zeroed but data clusters may remain. Recovery tools use these remnants.

NTFS stores all metadata in the Master File Table (MFT). Each MFT record describes a file. The $LogFile records changes for crash recovery. $UsnJrnl (change journal) records every file operation — a goldmine for timeline reconstruction even after deletion.

Autopsy and Sleuth Kit recover deleted files by scanning for intact MFT entries with deallocated data clusters and by file carving — identifying file magic bytes (signatures) in raw cluster data regardless of file system metadata.

File carving recovers files based on headers and footers (magic bytes) from unallocated space. JPEG starts with FF D8 FF. PDF with 25 50 44 46. ZIP with 50 4B 03 04. Scalpel and PhotoRec are the primary carving tools.

Autopsy generates a timeline from MAC times (Modified, Accessed, Changed) and $UsnJrnl entries. Filter around the suspected compromise time to see what files were created, modified, or deleted — reconstructing attacker actions chronologically.

The Windows Registry records installed software, USB devices (USBSTOR), recent documents, last logged-in user, and run key persistence. Registry Explorer and RegRipper extract and parse registry hives from disk images for artifact analysis.

Browser history, cookies, cached files, and form data are stored in SQLite databases. Chrome uses LevelDB. Extracting these artifacts reveals attacker reconnaissance activity, exfiltration staging, and web-based command channels.

Why must a write blocker be used when examining evidence drives?

Disk forensics starts with forensically sound imaging using write blockers and hash verification. NTFS MFT, $UsnJrnl, registry hives, browser databases, and file carving from unallocated space collectively enable reconstruction of attacker activity on compromised systems.