IY467 Lab 2 - Imaging A Drive

Lab 2 - Creating and verifying an image
Task 1: Working with FTK image

You will need a USB flash drive (memory stick). A smallish one (2 or 4GB) that is not too
full will make it quicker to copy!
Download FTK Imager from my OneDrive:

AccessData_FTK_Imager_4.5.0_(x64).exe
Or from Access Data: https://accessdata.com/product-download/ftk-imager-

version-4-5
Double click the exe to install FTK Imager. If prompted to allow changes on your
system from the FTK Imager, click Yes (Figure 1).
Figure 1: Allow changes from FTK Imager.
Your FTK Imager will then become active.
1. Plug in your USB drive. First you are going to access the drive as it is, to verify it and
compute the hash values as it is. From the File menu select Add Evidence Item. In the
source selection dialog select Physical Drive. (Fig. 2)
Figure 2: Select the Physical Drive option.
2. Select the Source Drive. Make sure you choose the USB stick you have inserted and
not your hard drive! Click Finish.
Figure 3. Carefully select the right source drive
3. Select the drive in the Evidence Tree.
Figure 4. Select the drive in the evidence tree
4. Then from the File menu choose Verify Drive/Image. Record the MD5 and SHA1 hash
values. (You could screenshot or snip the image, or copy the text for each hash and
paste it into your notes.) Close the verification results dialog.
Figure 5. Record the verification results
5. Now you are going to image your USB drive as follows:

Select the File menu of your AccessData FTK Imager and click on the Create Disk
Image option. Again, choose Physical Drive as your source (because the USB drive
is a physical drive) and click Next.
6. You will now select the Source Drive. From the Source Drive Selection drop down
menu select the USB drive you want to image. CAUTION!!! Be even more careful this
time and DO NOT select the option with your hard drive unless you want to
overflow your disk with a copy of itself! When the USB drive is selected, click
Finish (Figure 9).
Figure 9: Select the USB drive.
7. Once you selected the Source, you will also have to select the Destination, where
your new image will be stored. In the Create Image pop-up window, select Add...
to add the destination (Figure 10).
Figure 10: Click on the Add... option.
8. Now choose the Image Type of your Destination file. Choose the Raw (dd) option.
(E01 is a file format used by EnCase, but it contains various metadata. Thus, it would
not make sense to compare the E01 file with the original. The raw file produced by
dd is a bit-to-bit copy of the original image.)
Click Next.
9. In the next dialog, add a detailed description of the evidence you are about to
image, as seen in figure 11. You can just choose your own case and evidence
numbers, description, and notes. Click Next.
Figure 11: Provide detailed information about the image.
10. In the new pop-up window click Browse and select the destination folder – I
suggest creating a new folder called myUSBimage somewhere easy to find like
your desktop as your destination folder – click OK (Figure 12).
Figure 12: Choose your destination folder.
11. Name the image file as you wish (I named mine as USBimage). Change the “Image
Fragment Size (MB)” field to 0 – this forces it to copy the image to one location in
memory, rather than fragment it and place it wherever it fits. Click Finish (Figure 13).
Figure 13: Name the image and change the Image Fragment Size before you click
Finish.
12. Click Start. The imaging process will start, as figure 14 shows. Be patient, it will
take some time. Imagine how lengthy the imaging process can be when analysts
are imaging hard drives with a capacity of several TB!
Figure 14: FTK Imager images the USB drive.
13. When the imaging process is completed, FTK Imager will create and show
Verification Results (Figure 15). MD5 and SHA1 values of the original data and
the acquired image are included. The report recognises if these values are the
same and prints the result at the Verify result field as: Match.
Check for yourself that the hash values produced now still match the initial hash
value you recorded at step 5.
Figure 15: Verification Results produced by FTK Imager.
FTK Imager also saves a more comprehensive and detailed copy of this report in your
Destination folder. You can open this directly from Windows Explorer.
On your Desktop go to the folder where you saved the image. In this folder you will
find the image file you created, and a text file with metadata (including the Hash
values of the image and the verification results). Figure 16 shows the report from my
acquisition experiment. Hash values should match and the acquired image should be
marked as Verified.
Task 2: Copying files directly.
This may seem like a lot of work to copy files from a memory stick! Let’s see what
happens if we copy some files directly.
14. Browse to the memory stick in Windows Explorer. Select a folder from it and copy it
into your Documents.
15. Return to FTK Imager and select the USB drive in the Evidence Tree. Then from the
File menu choose Verify Drive/Image. Record the MD5 and SHA1 hash values as you
did before. Close the verification results dialog.
Compare the hash values you get now to your original hash values. Are they
different? If they are different, why this might have happened?
The consequences in a real case could be serious. If the forensic examiner cannot
show the court that the evidence presented matches the evidence originally
seized from the suspect, the case could be lost. How can a forensic examiner
prevent such unpleasant and unwanted events from happening during the data
acquisition process?
Forensic examiners use a software or hardware writeblocker to prevent anything

being written to the evidence drive.
Conclusions
In this lab session you acquired an image of a USB drive using FTK Imager on
Windows. In addition, you learned how you can verify that the acquired images are
exact copies of the original data, using the MD5 and SHA1 algorithms.

IY467 Lab 2 - Imaging A Drive

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IY467 Lab 2 - Imaging A Drive

Uploaded by

Copyright:

Available Formats

Lab 2 - Creating and verifying an image

Task 1: Working with FTK image

Download FTK Imager from my OneDrive:

Or from Access Data: https://accessdata.com/product-download/ftk-imager-

Figure 1: Allow changes from FTK Imager.

Your FTK Imager will then become active.

Figure 3. Carefully select the right source drive

3. Select the drive in the Evidence Tree.

Figure 4. Select the drive in the evidence tree

5. Now you are going to image your USB drive as follows:

Figure 9: Select the USB drive.

Figure 11: Provide detailed information about the image.

Figure 15: Verification Results produced by FTK Imager.

Task 2: Copying files directly.

Forensic examiners use a software or hardware writeblocker to prevent anything

You might also like