We use cookies to ensure you get the best user experience. For more information see our cookie policy.
Forensic Imaging
Learn the basic concepts of forensic imaging.
Task 1: Introduction
Introduction
In Digital Forensics, imaging is the process of creating an exact, bit-by-bit copy of digital storage media. This process ensures that all the data, including deleted files, hidden files, and unallocated space, is captured. By generating a forensic image, we preserve the original data, allowing for a thorough examination.
The primary goal of this process is to create a verifiable and reliable copy that can be used in investigations and legal proceedings. This process is crucial for maintaining the integrity of digital evidence, ensuring that the original data remains untouched and admissible in legal matters.
Furthermore, the process plays a critical role in maintaining the chain of custody, a crucial aspect of legal proceedings. By documenting the handling and transfer of digital evidence, we can demonstrate that the data has been preserved correctly and has not been tampered with, providing a reliable and transparent method for examining it.
Learning Objectives
Learn the basics of the forensic imaging process
Explore different environment settings for imaging
Learn how to create a raw image from an attached device
Some topics not touched on in this room are performance and timing; while these topics are relevant to the imaging procedure, they were intentionally left behind to avoid the focus on the process itself.
Answer the questions below
Click to complete the task.
Task 2: Preparation
The process of imaging a disk starts by identifying the target drive, preparing it for imaging, and then creating the image file which is later verified for integrity. This needs to be performed in an environment that allows us to perform these tasks and also ensures the process is properly logged.
Each operating system has specific file system structures and configurations that require different imaging tools and techniques. In our scenario, we will use Linux as the OS to acquire the data and create a forensic image of a drive. The use of open-source software for image acquisition is an advantage in many cases since it can satisfy guidelines for evidential reliability that need to be fulfilled. The Linux kernel also supports many file systems, which is a big advantage when analyzing different media types.
Start the attached machine in this task by clicking the Start Lab Machine button. A split-screen view of the VM will appear. In case the VM is not visible, use the blue Show Split View button at the top of the page. Alternatively, you can access the machine via SSH using the following credentials below.
Username
analyst
Password
forensics
IP
MACHINE_IP
Write-Blockers
It is important to mention that write-blockersare usually required when manipulating physical disks. A write-blocker is a device used to prevent any modifications to data on a storage device during analysis. It ensures reading data without risking changes to the original evidence.
Write-blockers work by physically intercepting all drive commands that write data sent between the disk being imaged and the OS attached to it.
Audit Trail
An audit trail is a chronological record that tracks actions and events within a system, providing a detailed history for accountability and security. It ensures traceability by documenting each step. This step can be performed with different parameters depending on the legal or compliance framework required by the task.
We can manually or automatically record the actions and events with varying detail levels. Since we need to preserve the evidence and keep track of our activities, let's explore some methods for tracking tasks and automating command-line activity logging to help us have this audit trail of our process.
If we are using bash, the history command can help us log our activity. It can be saved using a timestamp and preserved in a file. Below, we can observe a chart with some commands recommended to use during our session.
set -o history
Enables command history in the shell, allowing it to record the commands you enter.
shopt -s histappend
Ensures that the command history is appended to the history file instead of overwriting it when the shell exits.
export HISTCONTROL=
Clears any settings that control which commands are saved in the history, ensuring all commands are recorded.
export HISTIGNORE=
Clears any settings that ignore specific patterns of commands, so all commands are saved in the history.
export HISTFILE=~/.bash_history
Sets the file where the command history is saved.
export HISTFILESIZE=-1
Sets no limit on the number of lines stored in the history file.
export HISTSIZE=-1
Sets no limit on the number of commands retained in the shell history.
export HISTTIMEFORMAT="%F-%R "
Formats timestamps in the history as "YYYY-MM-DD HH" for each command.
Another good practice is to log all sessions. This could be achieved with bash internals, but other easy-to-use software can achieve the same, like script, a UNIX tool present in several Linux distributions, or similar tools like ttyrec.
Finally, we should always save the output of any command we execute to a file if possible. While this may not be the case in the next examples, this is to provide a more analytic approach to them, but it's recommended to do it in a real scenario.
Again, these requirements can be more demanding depending on the legal frameworks and the needs of the investigation.
Accessing the File System
While the disk and devices used may differ depending on the requirements and the environment, the process is similar for all disks physically or virtually attached to the Linux OS. Once we have our preparation setup and logging our steps, let's execute the df command to see the attached devices on the lab machine.
Drives are attached as devices under the /dev directory. In the output above, the current disk used by the OS is listed under /dev/root. Our device is not mounted yet, and since it is a Virtual Disk attached to a loop interface, it will not appear using the command df. This is also common for physical disks when not directly attached.
We can still list block devices using the lsblk command with the -a option to list all devices, as shown below.
Above, we can observe the loop11 interface initialized with 1.1 GB, which matches our Disk Size. This should also be noticed since we need to know that we have enough space to create the images either on the disk we will copy it or on the disk where we will save the image. In our case, is the xvda block, which corresponds to the /dev/root/. The partition is 40 GB in size.
Note: The upcoming terminal outputs and the ones shown above may sometimes differ from the outputs of the attached VM. This is because the loop devices might change. It is advised to follow the practical commands by identifying the loop device with a 1.1 GB size, which in our case is loop11.
We can get more info about the device using the losetup command with the -l option to list the device and the assigned interface path, in this case /dev/loop11.
It is possible to acquire further information like the UUID of the image using the blkid with the interface as an argument, as demonstrated in the following example.
With the information above logged into our notes, we should proceed to create the disk's image. Note that if we were using a physical disk, we could also use commands like hparn to get information about the manufacturer, serial number, and other required data.
Answer the questions below
What command can be used to list all block devices in Linux OS?
Which bash command displays all commands executed in a session?
Task 3: Creating a Forensic Image
Now that we have identified the device, we want to create an image. Let's go ahead and copy this disk to a raw image file for further inspection. This could also be done to another disk if needed, which is a common practice, but in this case, we will do it to a local file in our system with the .img extension to identify the file as an image.
As we recall from our previous task, there is a great variety of tools we can use to create images. We will use dc3dd in this example, an enhanced version of the UNIX command dd. Below, you can find a list of some common tools used to create images.
dd
A standard Unix utility for copying and converting files, often used for creating raw disk images
dc3dd
An enhanced version of dd with additional features for forensic imaging, including hashing and logging
ddrescue
A data recovery tool that efficiently copies data from damaged drives, attempting to rescue as much data as possible
FTK Imager
A GUI-based tool for creating forensic images, widely used for its ease of use and comprehensive features
Guymager
A GUI-based forensic imaging tool that supports various image formats and provides detailed logs
EWF tools (ewfacquire)
Tools for creating and handling Expert Witness Format (EWF) images, often used in digital forensics
Imaging
To start, let's execute the dc3dd command with the following parameters:
The if option (input file), indicates the device we want to copy; in this case, /dev/loop11
The of option (output file) indicates where we want to write the disk bytes, in this case, a file named example1.img
The log options will save all the output into a file. In our example, imaging_loop11.txt
Below, we can observe the command output of dc3dd using the parameters mentioned.
Forensic Imaging
user@tryhackme$ sudo dc3dd if=/dev/loop11 of=example1.img log=imaging_loop11.txt
dc3dd 7.2.646 started at 2024-06-28 22:58:59 +0000
compiled options:
command line: dc3dd if=/dev/loop11 of=example1.img log=imaging_loop11.txt
device size: 2252800 sectors (probed), 1,153,433,600 bytes
sector size: 512 bytes (probed)
1153433600 bytes ( 1.1 G ) copied ( 100% ), 13 s, 84 M/s
input results for device `/dev/loop11':
2252800 sectors in
0 bad sectors replaced by zeros
output results for file `example1.img':
2252800 sectors out
dc3dd completed at 2024-06-28 22:59:12 +0000
From the output above, we can confirm that the operation seemed to be successful and that we created a file of the same size, as shown below.
Forensic Imaging
user@tryhackme$ ls -alh example1.img
-rw-r--r-- 1 root root 1.1G Jun 28 22:28 example1.img
Now, let's check what other activities we can perform in the next rooms after the imaging process is over.
Answer the questions below
Click to complete the task.
Task 4: Integrity Checking
Integrity checking in digital forensics imaging is crucial for ensuring that the forensic copy of data is identical to the original. This process uses cryptographic hash functions, such as MD5, SHA-1, or SHA-256, to generate unique hash values for both the original and the copied data. By comparing these hash values, investigators can confirm that the evidence was not altered during the imaging process, maintaining its reliability and admissibility in legal proceedings.
Methods for integrity checking include using tools that automatically calculate and verify hashes during the imaging process. Tools like dc3dd generate and compare hash values in real-time, providing an added layer of assurance. Regular integrity checks throughout the investigation ensure that data remains unchanged, preserving the chain of custody.
Let's again list the block devices on our system using the command lsblk with -l to list the devices.
We can observe that the device is still listed in /dev/loop11. Let's ensure our imaging process was successful. To do that, let's calculate the MD5 hash of the image we created, example1.img, and let's do the same for the device/dev/loop11. The results should match.
As shown above, the calculated hash indeed matches, passing the integrity check for this image we created. Thus, we can confirm that the imaging process has been successful through hashing.
Answer the questions below
What is the MD5 hash of the image "exercise.img" located in /home/analyst/?
Task 5: Other Types of Imaging
It is worth noting that other types of imaging procedures can be performed, not only on disk devices. These can include:
Remote Imaging
Involves creating an image over the network, allowing it to acquire data without physical access to the device.
USB Images
Creates an image of a USB drive's contents.
Docker Images
While not strictly an image, it creates a snapshot of a Docker container's filesystem and configuration.
Once we have an image, we can also verify that the image is working and can be used to inspect it; for that, we could mount the image to verify the process is complete correctly. Let's go ahead and mount the image we created, example1.img.
As we observed before, our disk assigned to the loop interface loop11 is not mounted as the command df displays.
Great! We can list the directories on the mounted directory /mnt/example1.
Answer the questions below
Mount the image "exercise.img" located in the analyst home directory folder. What is the content of the file "flag.txt" located within exercise.img?
Task 6: Practical Exercise
Note: Before you move forward with this task, please turn off the VM in task 2.
Access the machine with the details below to complete the exercise and answer the question for this task.
You can start the attached machine in this task by clicking the Start Lab Machine button. A split-screen view of the VM will appear. In case the VM is not visible, use the blue Show Split View button at the top of the page. Alternatively, you can access the machine via SSH using the credentials below.
Username
practical
Password
forensics
IP
MACHINE_IP
Answer the questions below
Create an image of the attached 1gb loop device. What is the MD5 hash of the image?
Mount the image from the 1 GB loop device. What is the content of the file "flag.txt"?
Task 7: Conclusion
In this room, we learned the basics of forensic imaging, defining the main concepts and performing tasks that will put us in practical scenarios where we performed imaging of devices, mount, and check their integrity through hashing algorithms.
You can learn more about forensic imaging or more about Linux forensics in the rooms below.
To access material, start machines and answer questions login.
Introduction
In Digital Forensics, is the process of creating an exact, bit-by-bit copy of digital storage media. This process ensures that all the data, including deleted files, hidden files, and unallocated space, is captured. By generating a forensic image, we preserve the original data, allowing for a thorough examination.
The primary goal of this process is to create a verifiable and reliable copy that can be used in investigations and legal proceedings. This process is crucial for maintaining the of digital evidence, ensuring that the original data remains untouched and admissible in legal matters.
Furthermore, the process plays a critical role in maintaining the , a crucial aspect of legal proceedings. By documenting the handling and transfer of digital evidence, we can demonstrate that the data has been preserved correctly and has not been tampered with, providing a reliable and transparent method for examining it.
Learning Objectives
Learn the basics of the forensic imaging process
Explore different environment settings for imaging
Learn how to create a raw image from an attached device
Some topics not touched on in this room are performance and timing; while these topics are relevant to the imaging procedure, they were intentionally left behind to avoid the focus on the process itself.
Answer the questions below
Click to complete the task.
Set up your virtual environment
To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine - Task 2
Status:Off
The process of a disk starts by identifying the target drive, preparing it for imaging, and then creating the image file which is later verified for . This needs to be performed in an environment that allows us to perform these tasks and also ensures the process is properly logged.
Each operating system has specific structures and configurations that require different imaging tools and techniques. In our scenario, we will use as the to acquire the data and create a forensic image of a drive. The use of open-source software for image acquisition is an advantage in many cases since it can satisfy guidelines for evidential reliability that need to be fulfilled. The Linux kernel also supports many file systems, which is a big advantage when analyzing different media types.
Start the attached machine in this task by clicking the Start Lab Machine button. A split-screen view of the will appear. In case the VM is not visible, use the blue Show Split View button at the top of the page. Alternatively, you can access the machine via using the following credentials below.
Username
analyst
Password
forensics
IP
MACHINE_IP
Write-Blockers
It is important to mention that write-blockersare usually required when manipulating physical disks. A write-blocker is a device used to prevent any modifications to data on a storage device during analysis. It ensures reading data without risking changes to the original evidence.
Write-blockers work by physically intercepting all drive commands that write data sent between the disk being imaged and the OS attached to it.
Audit Trail
An audit trail is a chronological record that tracks actions and events within a system, providing a detailed history for accountability and security. It ensures traceability by documenting each step. This step can be performed with different parameters depending on the legal or compliance framework required by the task.
We can manually or automatically record the actions and events with varying detail levels. Since we need to preserve the evidence and keep track of our activities, let's explore some methods for tracking tasks and automating command-line activity logging to help us have this audit trail of our process.
If we are using bash, the history command can help us log our activity. It can be saved using a timestamp and preserved in a file. Below, we can observe a chart with some commands recommended to use during our session.
set -o history
Enables command history in the shell, allowing it to record the commands you enter.
shopt -s histappend
Ensures that the command history is appended to the history file instead of overwriting it when the shell exits.
export HISTCONTROL=
Clears any settings that control which commands are saved in the history, ensuring all commands are recorded.
export HISTIGNORE=
Clears any settings that ignore specific patterns of commands, so all commands are saved in the history.
export HISTFILE=~/.bash_history
Sets the file where the command history is saved.
export HISTFILESIZE=-1
Sets no limit on the number of lines stored in the history file.
export HISTSIZE=-1
Sets no limit on the number of commands retained in the shell history.
export HISTTIMEFORMAT="%F-%R "
Formats timestamps in the history as "YYYY-MM-DD HH" for each command.
Another good practice is to log all sessions. This could be achieved with bash internals, but other easy-to-use software can achieve the same, like script, a UNIX tool present in several Linux distributions, or similar tools like ttyrec.
Finally, we should always save the output of any command we execute to a file if possible. While this may not be the case in the next examples, this is to provide a more analytic approach to them, but it's recommended to do it in a real scenario.
Again, these requirements can be more demanding depending on the legal frameworks and the needs of the investigation.
Accessing the File System
While the disk and devices used may differ depending on the requirements and the environment, the process is similar for all disks physically or virtually attached to the Linux OS. Once we have our preparation setup and logging our steps, let's execute the df command to see the attached devices on the lab machine.
Drives are attached as devices under the /dev directory. In the output above, the current disk used by the OS is listed under /dev/root. Our device is not mounted yet, and since it is a Virtual Disk attached to a loop interface, it will not appear using the command df. This is also common for physical disks when not directly attached.
We can still list block devices using the lsblk command with the -a option to list all devices, as shown below.
Above, we can observe the loop11 interface initialized with 1.1 GB, which matches our Disk Size. This should also be noticed since we need to know that we have enough space to create the images either on the disk we will copy it or on the disk where we will save the image. In our case, is the xvda block, which corresponds to the /dev/root/. The partition is 40 GB in size.
Note: The upcoming terminal outputs and the ones shown above may sometimes differ from the outputs of the attached VM. This is because the loop devices might change. It is advised to follow the practical commands by identifying the loop device with a 1.1 GB size, which in our case is loop11.
We can get more info about the device using the losetup command with the -l option to list the device and the assigned interface path, in this case /dev/loop11.
It is possible to acquire further information like the UUID of the image using the blkid with the interface as an argument, as demonstrated in the following example.
With the information above logged into our notes, we should proceed to create the disk's image. Note that if we were using a physical disk, we could also use commands like hparn to get information about the manufacturer, serial number, and other required data.
Answer the questions below
What command can be used to list all block devices in Linux OS?
Which bash command displays all commands executed in a session?
Now that we have identified the device, we want to create an image. Let's go ahead and copy this disk to a raw image file for further inspection. This could also be done to another disk if needed, which is a common practice, but in this case, we will do it to a local file in our system with the .img extension to identify the file as an image.
As we recall from our previous task, there is a great variety of tools we can use to create images. We will use dc3dd in this example, an enhanced version of the UNIX command dd. Below, you can find a list of some common tools used to create images.
dd
A standard Unix utility for copying and converting files, often used for creating raw disk images
dc3dd
An enhanced version of dd with additional features for forensic imaging, including hashing and logging
ddrescue
A data recovery tool that efficiently copies data from damaged drives, attempting to rescue as much data as possible
FTK Imager
A GUI-based tool for creating forensic images, widely used for its ease of use and comprehensive features
Guymager
A -based forensic imaging tool that supports various image formats and provides detailed logs
EWF tools (ewfacquire)
Tools for creating and handling Expert Witness Format (EWF) images, often used in digital forensics
To start, let's execute the dc3dd command with the following parameters:
The if option (input file), indicates the device we want to copy; in this case, /dev/loop11
The of option (output file) indicates where we want to write the disk bytes, in this case, a file named example1.img
The log options will save all the output into a file. In our example, imaging_loop11.txt
Below, we can observe the command output of dc3dd using the parameters mentioned.
Forensic Imaging
user@tryhackme$sudo dc3dd if=/dev/loop11 of=example1.img log=imaging_loop11.txtdc3dd 7.2.646 started at 2024-06-28 22:58:59 +0000
compiled options:
command line: dc3dd if=/dev/loop11 of=example1.img log=imaging_loop11.txt
device size: 2252800 sectors (probed), 1,153,433,600 bytes
sector size: 512 bytes (probed)
1153433600 bytes ( 1.1 G ) copied ( 100% ), 13 s, 84 M/s
input results for device `/dev/loop11':
2252800 sectors in
0 bad sectors replaced by zeros
output results for file `example1.img':
2252800 sectors out
dc3dd completed at 2024-06-28 22:59:12 +0000
From the output above, we can confirm that the operation seemed to be successful and that we created a file of the same size, as shown below.
Now, let's check what other activities we can perform in the next rooms after the imaging process is over.
Answer the questions below
Click to complete the task.
checking in digital forensics is crucial for ensuring that the forensic copy of data is identical to the original. This process uses cryptographic hash functions, such as , SHA-1, or , to generate unique hash values for both the original and the copied data. By comparing these hash values, investigators can confirm that the evidence was not altered during the imaging process, maintaining its reliability and admissibility in legal proceedings.
Methods for integrity checking include using tools that automatically calculate and verify hashes during the imaging process. Tools like dc3dd generate and compare hash values in real-time, providing an added layer of assurance. Regular integrity checks throughout the investigation ensure that data remains unchanged, preserving the chain of custody.
Let's again list the block devices on our system using the command lsblk with -l to list the devices.
We can observe that the device is still listed in /dev/loop11. Let's ensure our imaging process was successful. To do that, let's calculate the MD5 hash of the image we created, example1.img, and let's do the same for the device/dev/loop11. The results should match.
As shown above, the calculated hash indeed matches, passing the integrity check for this image we created. Thus, we can confirm that the imaging process has been successful through hashing.
Answer the questions below
What is the MD5 hash of the image "exercise.img" located in /home/analyst/?
It is worth noting that other types of procedures can be performed, not only on disk devices. These can include:
Remote Imaging
Involves creating an image over the network, allowing it to acquire data without physical access to the device.
USB Images
Creates an image of a USB drive's contents.
Docker Images
While not strictly an image, it creates a snapshot of a Docker 's filesystem and configuration.
Once we have an image, we can also verify that the image is working and can be used to inspect it; for that, we could mount the image to verify the process is complete correctly. Let's go ahead and mount the image we created, example1.img.
As we observed before, our disk assigned to the loop interface loop11 is not mounted as the command df displays.
Great! We can list the directories on the mounted directory /mnt/example1.
Answer the questions below
Mount the image "exercise.img" located in the analyst home directory folder. What is the content of the file "flag.txt" located within exercise.img?
Set up your virtual environment
To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine - Task 6
Status:Off
Note: Before you move forward with this task, please turn off the in task 2.
Access the machine with the details below to complete the exercise and answer the question for this task.
You can start the attached machine in this task by clicking the Start Lab Machine button. A split-screen view of the VM will appear. In case the VM is not visible, use the blue Show Split View button at the top of the page. Alternatively, you can access the machine via using the credentials below.
Username
practical
Password
forensics
IP
MACHINE_IP
Answer the questions below
Create an image of the attached 1gb loop device. What is the MD5 hash of the image?
Mount the image from the 1 GB loop device. What is the content of the file "flag.txt"?
In this room, we learned the basics of forensic , defining the main concepts and performing tasks that will put us in practical scenarios where we performed imaging of devices, mount, and check their through hashing algorithms.
You can learn more about forensic imaging or more about forensics in the rooms below.
