Imazhimi i një Disku

The first step in any disk forensics workflow is to create a bit-for-bit image of the target media without altering the original.

Imaging is done with the media connected through a hardware write-blocker (Tableau, WiebeTech) or via software write protection on a trusted Linux acquisition station. The standard tools are dd, dcfldd (a dd fork with hashing and progress output) and the more modern ewfacquire from libewf, which produces the E01 format used by EnCase and most commercial forensic suites. E01 includes metadata, compression and per-block CRC checks, and is the de-facto archival format for disk images. Every acquisition must be documented and hashed. Before imaging, compute an MD5 and SHA-256 of the source; after imaging, compute the hashes of the image; both sets must match. Hash values, serial numbers, timestamps, tool versions and operator identity all go into a chain-of-custody form that travels with the evidence for its entire lifecycle. If the chain breaks, the evidence may be inadmissible in court. For volatile acquisitions — a running laptop you cannot turn off — you additionally capture RAM first, then image the disk. The Volatility Foundation maintains several tools for this and has become the default for memory forensics workflows. Always work on copies: analysts analyze a working copy of the image and keep the original sealed for integrity.

Mjete:

• dd, dcfldd, dc3dd — për imazhim.
• FTK Imager (Windows) — profesional, falas.
• Guymager (Linux) — GUI për imazhim.
• md5sum/sha256sum për hash para/pas.

Imazhim i bit-by-bit me dc3dd dhe write blocker:

# Hash para imazhimit
sha256sum /dev/sdb > source.sha256
# Imazhim
dc3dd if=/dev/sdb hash=sha256 log=image.log hof=/evidence/disk.img
# Verifikim pas
sha256sum /evidence/disk.img

1. Imazho një USB stick (lab) me dc3dd dhe verifiko hash-et.
2. Shpjego rolin e një write blocker në chain of custody.

• NIST — Computer Forensics Tool Testing (CFTT).
• SANS FOR508 — Advanced Forensics.