15.4 Drive Imaging
Imaging a suspect's hard drive is one of the most critical functions of the computer forensic processarguably the most critical element. It is extremely important that no data be written to the suspect's hard drive during this process. To ensure the integrity of the 40+ hard drives to be imaged and analyzed in this case, we used the Linux DD function as the method for imaging.
Using Linux DD means attaching the suspect's hard drive to the analysis system and copying all of its data to a file on the analysis drive. Linux DD makes a bit-for-bit copy of the suspect's drive and writes all of the data to what is commonly referred to as a raw data file. This file contains everything that was originally stored on the suspect's drive, including the logical file structure and unallocated space. By using a large hard drive (300GB) for our analysis drive, we were able to store up to five or six suspects' raw data files on a single drive.
Here's the command for using DD:
# > dd if=/dev/hda of=/mnt/image.dd
where /dev/hda is the physical address of the suspect's hard drive, and /mnt/image.dd is the raw data file to which the suspect's hard drive is being written.
It is imperative to validate that every bit and byte of the suspect's computer was properly copied to your analysis drive. To accomplish this validation, before using DD we used the MD5 checksum utility, called md5sum, that is built into Linux. We first performed a checksum on the suspect's hard drive, then we used DD to make the image, and finally we performed a checksum on the suspect's raw data file. The results of the two checksum operations were compared to make sure that the contents of the suspect's hard drive and our raw data file were identical.
Here's the command for using the Linux MD5 checksum utility:
# > md5sum /dev/hda 77538d7cdb02e592e1787f6905235b89 /dev/hda # > md5sum /mnt/image.dd 77538d7cdb02e592e1787f6905235b89 /mnt/image.dd
Comparing the results of the two checksum actions will tell you if the DD image copy is exactly the same as the original.