Making complex data simple and compelling
From digital device to digital evidence
Unlock your vehicle's digital evidence potential
Forensic Analysis and Enhancement
Investigating and analyzing financial records
Gain access to the online accounts of deceased loved ones
Clear, precise evidence for a messy world
Expert reports to suit your specific needs
We can locate people anywhere
Stop worrying and learn the truth
Prevent, Detect, Respond To Cyberattacks
First response is crucial. Every minute counts.
The first response is critical to reduce liability
Detection & Removing Spyware Services
Reduce your electronic risk from digital transmittals
Find out who you are really talking to
Experienced, Confidential Services
Swift, professional incident response
Complicated cases require compelling digital facts
Find, recover and document digital evidence
Bring solid evidence before a judge
Cases can be investigated using Social Media
Divorce, custody battles, and other
Win the most important battle of your life
Everything you need
Effective Expert Witness in Court
Evidence shows who is telling the truth
Subpoena power yields strong evidence
Digital evidence can build a strong defense
Go to court with compelling digital evidence
Digital devices are an integral part of our lives. Therefore, digital evidence, namely, evidence obtained from various digital devices, is increasingly used in investigations in the corporation or law enforcement.
A feature of digital evidence is that it can be easily damaged or destroyed. Often, this happens unintentionally. For example, when technical staff try to restore the computer after an incident. A typical carrier of digital evidence is a hard drive. Today we will consider: how to make the forensic image of the hard drive by example of making a copy of the hard drive of the laptop.
Types of forensic copies:
There are two main types of forensic copies.
Extracting the hard drive.
For our example, we will consider creating a forensic image of the FUJITSU SIEMENS Amilo M3438G hard drive.
Fig. 1. Appearance of the laptop.
Extracting the hard drive from the laptop can present certain difficulties. That’s why we recommend that you first find in the “Internet” network a video that shows how to disassemble a particular laptop model so as not to damage it. Usually, such a video can be found on request: “How to disassemble ‘laptop model’ “.
Fig. 2. The results of the search query “How to disassemble M3438G”.
Typically, the laptop model is indicated on the label located on the bottom of the laptop or in the battery compartment. When you remove the hard drive from the laptop, remember that there can be more than one hard drive in the laptop. There are models in which 4 hard drives are installed. Furthermore, an additional hard drive may be installed into the compartment DVD-drive. We are lucky. Only one hard drive is installed in our laptop.
Fig. 3. Ejected hard drive.
Creating the forensic image of the hard drive.
When creating forensic images of media, used hardware or software recording blockers. This is done in order to exclude the possibility of accidental modification of data on them. We will use the hardware lock WiebeTECH Forensic UltraDock V5. This blocker emulates the functions of writing, moving, deleting files on a connected hard drive for proper operation in a Windows environment. In this case, in fact, no data on the source drive is changed.
Fig. 4. Appearance of the write blocker.
This blocker has the following advantages over others:
To this blocker, you can connect hard drives with SATA and IDE interfaces. If your laptop uses SSD hard drives, you will need an appropriate adapter to connect its.
Fig. 5. Adapters for SSD drives.
We will use the program “Belkasoft Acquisition Tool” to create a forensic image. This program is free. It is necessary to go to the address: http://belkasoft.com/get and fill in a short form for its receipt. “Belkasoft Acquisition Tool” is a universal utility that allows you to create forensic images of hard drives, mobile devices, extract data from cloud storages. We connect the extracted hard drive, using the write blocker to our computer and run the “Belkasoft Acquisition Tool”. We will see the main window of the program where we will be asked to choose the data source: hard drive, mobile device or cloud storage.
Fig. 6. The main window of Belkasoft Acquisition Tool.
Click on the ‘Drive’. After that, a window will open, in which we will be asked to choose: the device to be copied; specify the place where the forensic image will be created; specify file name and format, etc.
Fig. 7. A window for selecting a drive to create its forensic image and setting its parameters (location, name, format, etc.).
As you can see on Fig. 7, the hard drive, the forensic image of which we will create, is connected as ‘PHYSICALDRIVE2’. We will create a file named ‘image.E01’, for which we calculate checksum SHA-1 and MD5. Calculation checksum is necessary in order to confirm the authenticity of the forensic image from the time it was created to the time of using evidence obtained from it. After that, you need to click on the ‘Next’, which will start the process of creating a forensic image of the hard drive.
Fig. 8. Display the process of creating a forensic image of the hard drive.
In the end, we get the file ‘image.E01’, which contains a forensic image of the hard drive.
In this article, we looked at the process of creating a forensic image of a hard drive, using the example of a hard drive extracted from the laptop. They learned about: what methods are used to extract a hard drive from the laptop; what hardware devices are used to connect hard drive, when creating forensic images of hard drives. We thoroughly acquainted with the process of creating a forensic image of the hard drive.
Igor Mikhaylov & Oleg Skulkin
E01 is just one subtype in Expert Witness Disk Image Format. And yes, it was made popular by EnCase, but it is not EnCase format.
Expert Witness (for Windows) was the original name for EnCase (dating back to 1998). The product was renamed because it intruded the Expert Witness trademark held by ASR Data. The Encase image file format therefore is also referred to as the Expert Witness (Compression) Format.
Save my name, email, and website in this browser for the next time I comment.
Speak to a Specialist Now