Hi and welcome to this video drive imaging with DC 3D in the previous video we introduce to command
line forensic acquisition tools DC F.L. DD and DC 3D and looked at the manual page of the DC 3 DD showing
its various options in this video we're going to take a look at how to identify our target drive among
the drives attached to the forensic workstation.
Then we'll cover the procedure of acquiring the forensic image of the drive with DC 3D.
Finally how do cryptographically signed the hash log file with GBG.
As a practical example we're going to acquire the image of the 40 gigabyte hard drive shown in this
picture which we imagine having removed from an old suspect computer we assume having attached our target
drive to the forensic workstation using a right blocking mechanism as described in the first video the
section introduction to forensic imaging.
The first step is the correct identification of the drive.
Among the other drivers on our system remember that Linux identifies drivers as block device files under
the dash dev directory.
Usually in the form of Dash dev dash STA X dash STA X where X is a letter that identifies the drive
while N is the number that represents the partition number to list all the attached drives.
We can use the F disk tool followed by the negative option
the output of the command shows for each drive the capacity and the total number of sectors the disk
label type and the disk ID below.
They list the partitions in which the disk is divided for each partition of the drive.
There are a lot of detailed information such as If the partition is bootable sectors where the partition
starts and ends the number of sectors the size and the file system type.
In our case since we know that the target drive is 40 gigabytes of size we must repots that it's represented
by device dev STA because it has total capacity of 40 gigabytes.
The first number being the total capacity available to the user and we could see that the drive contains
only one partition that is marked with the NTFS file system.
In case you still have some doubt about the identification of the drive.
Recall that we can use the HD Park tool to obtain more detailed information about the drive so we run
the command
and the output of the command shows the model number and the serial number.
We can compare these two values with those printed on the drive itself so we can be sure that our drive
is correctly identified.
Having identified the drive we can run DC 3 DD to acquire its image.
First we had to decide a location where to store the output image file.
This location obviously must have enough free space to store it.
In our case we decided to store the image file on an external hard disk to see the device file attached
to see the device file associated with the disk.
We could run as usual the disk tool
as we notice the external 500 gigabyte hard disk is associated with the death SD device file.
We run the F dash h command to see the directory on which this device file is mounted.
Now we could run the DC three-D tool.
The first parameter to specify is I-F followed by the input device that in our case is dead.
Sta.
Then we should specify the H-2 a parameter that takes the path and the name of the image file where
to copy the input data.
We must specify a location where to save the image that has more free space than the size of the input
device
the H.F. option also calculates the hash of the output to verify its integrity.
This option must be used together with Dash hash specifying which algorithms to use.
In our case SH A-one SH's 8 2 5 6 an essay.
5:12 that we specify the dash log options to log any input output errors statistics and hashes.
We can now execute the command.
We must ensure before running the command that the input output file is not exchanged because otherwise
we would overwrite the input media.
And so we destroy the digital evidence the input file with then we don't specify any partition number
because we want to acquire the full disk.
We run the command and see that the output shows the progress of the acquisition the number of bytes
copied the elapsed time and the transfer rate.
Unfortunately we see that DC 3D determinates with an error saying that the output image file is too
large and showing having copied only four gigabytes.
That's because the external hard disk is formatted with the F-8 file system and it allows only a file
maximum size of four gigabytes.
Possible workaround could be as we've seen in the previous video to specify the HFS option to split
the image file into different files.
We add the S to the option and the format specifier to the filename and also the yoa as the option which
set the max file size.
That in our case should be less than the 4 gigabyte limit and so we set it for example to 3 gigabytes.
Now he could run the command again
after a while.
The DC 3 DD terminates without any air and so the image acquisition is successfully completed.
We could see that the destination directory contains all the image files and the log files.
Very good.
There's one more step to perform since we should be able to demonstrate that the hash is produced during
the acquisition really refer to the original evidence and that they've not been tampered with.
Afterwards it's a good practice to cryptographically sign the log file produced by DC 3 DD for this
purpose.
A useful tool is GBG the new version of PGE pretty good privacy.
You should assume that we've already generated a couple of public or private keys.
But if you don't know how to generate it please refer to the manual page of GPB to know how to generate
it to sign the log file.
We can execute the command.
We verify the signature with the command
great so now that we have the image file the hash and the signature of the log file.
The acquisition page is complete in this video.
We've seen how to image the target drive connect to the forensic workstation with the DC 3 D tool.
First we've covered how to identify the drive and then how to execute DC 3 DD with the appropriate options
to correctly acquire the image.
Finally we've covered cryptographically signing the hash file with GBG in the next video Android device
imaging with DC 3D.
We're going to cover the forensic acquisition of an Android device.