FTK imaging
Budget: ₹600 – ₹1,500 INR
Digital Forensics Imaging
The purpose of this lab is to demonstrate your ability to create bit-stream images and authenticate them properly. How to write block, use FTK Imager, and use dd will be demonstrated in class.
The submission will include imaging reports for some sections. An imaging report must contain the following sections to be valid.
File Downloads:
https://www.dropbox.com/s/qp4mf3goch0i3xk/lab_IH_a.dd?dl=0 https://www.dropbox.com/s/7ah5pn6s6pdmq9s/lab_IH_b.dd?dl=0
The reports must contain
● Imaging technician name and contact information
● Time and date image was created
● Physical and logical description of the device being imaged
● Write blocking method
● Imaging tool name and version (if dd include command used)
● Authentication record
● Technician comments
Report I : Using DD to create a logical Disk to File Image
Take a small thumb drive and image it using dd . Don’t forget to use write blocking and create an authentication record. For this report, an MD5 only will suffice. Tools can be used for doing hashing
Report II : Use DD to Perform a File to Disk Image
Every so often we have to restore a disk image for testing purposes. Use the DD command to restore the lab_IH_a.dd file to a 2 GB test thumb drive. Create an imaging report with the same sections, but explain you are creating a File to Disk for previewing purposes. In the notes section of the report describe the contents of the disk after it was restored. (If you are unable to do this as an admin on a Windows machine, please report what you could do.)
Report III : Use FTK Imager to Preview an Image
The benefit of creating an image file is so that one can use digital examination tools to examine it without destroying the original evidence. Load lab_IH_b.dd into FTK Imager or Autopsy. Create a simple report, but call this one a preview report. Describe what you did and answer the below questions. You can find the answer by exploring the interface.
1. How many JPG files are on this image?
2. How many word documents are on this image?
3. What kind of file system was this image taken from?
4. What was the volume serial number?
Report IV : Using FTK Imager or other Tool to Image
FTK Imager is a previewing and an imaging tool. Use FTK Imager to create an image file of the same thumb drive used in part I (Hash values should match). For the imaging report just edit the FTK Imager generated report to include your information.
Include in your notes a compare/contrast with DD vs one other tool.
As an alternative research, find another imaging tool and report your findings.
The purpose of this lab is to demonstrate your ability to create bit-stream images and authenticate them properly. How to write block, use FTK Imager, and use dd will be demonstrated in class.
The submission will include imaging reports for some sections. An imaging report must contain the following sections to be valid.
File Downloads:
https://www.dropbox.com/s/qp4mf3goch0i3xk/lab_IH_a.dd?dl=0 https://www.dropbox.com/s/7ah5pn6s6pdmq9s/lab_IH_b.dd?dl=0
The reports must contain
● Imaging technician name and contact information
● Time and date image was created
● Physical and logical description of the device being imaged
● Write blocking method
● Imaging tool name and version (if dd include command used)
● Authentication record
● Technician comments
Report I : Using DD to create a logical Disk to File Image
Take a small thumb drive and image it using dd . Don’t forget to use write blocking and create an authentication record. For this report, an MD5 only will suffice. Tools can be used for doing hashing
Report II : Use DD to Perform a File to Disk Image
Every so often we have to restore a disk image for testing purposes. Use the DD command to restore the lab_IH_a.dd file to a 2 GB test thumb drive. Create an imaging report with the same sections, but explain you are creating a File to Disk for previewing purposes. In the notes section of the report describe the contents of the disk after it was restored. (If you are unable to do this as an admin on a Windows machine, please report what you could do.)
Report III : Use FTK Imager to Preview an Image
The benefit of creating an image file is so that one can use digital examination tools to examine it without destroying the original evidence. Load lab_IH_b.dd into FTK Imager or Autopsy. Create a simple report, but call this one a preview report. Describe what you did and answer the below questions. You can find the answer by exploring the interface.
1. How many JPG files are on this image?
2. How many word documents are on this image?
3. What kind of file system was this image taken from?
4. What was the volume serial number?
Report IV : Using FTK Imager or other Tool to Image
FTK Imager is a previewing and an imaging tool. Use FTK Imager to create an image file of the same thumb drive used in part I (Hash values should match). For the imaging report just edit the FTK Imager generated report to include your information.
Include in your notes a compare/contrast with DD vs one other tool.
As an alternative research, find another imaging tool and report your findings.