Forensic Imaging and Verification
Forensic Imaging and Verification
This domain tests acquisition and integrity proof. The examiner must create a defensible duplicate, document errors, and verify hashes before analysis.
Core rules
- Distinguish physical images of a device, partition images, and logical file collections. Choose based on authority and scope.
- Use a validated hardware or software write blocker. Confirm it blocks writes before connecting evidence.
- Hash the source and image with MD5 and SHA-1 or SHA-256. Prefer SHA-256, and use two algorithms where policy requires. Collision concerns make MD5 alone weak for integrity claims.
- Common formats include raw/dd, EnCase E01, Ex01, and AFF4. E01 stores metadata and compression; segmentation must be documented.
- Verify after acquisition and after any transfer. Record bad sectors, read errors, and skipped ranges; do not silently omit them.
Worked example
A 1 TB drive has 12 unreadable sectors. The examiner uses ddrescue with a map file, acquires readable ranges, and records the bad-sector locations. Because the full source cannot be hashed consistently, the report states the acquired range and verifies that image hash. A full verification claim would be false; the limitation is disclosed.
Traps
Booting the source; using an untested write blocker; relying only on MD5; failing to re-hash after copying; imaging to the same disk; hiding read errors; not documenting tool versions and settings.
Key points
- Write blockers must be validated before use.
- Hash source and image; prefer SHA-256 plus a second algorithm.
- Document format, segmentation, and tool settings.
- Bad sectors and read errors must be disclosed.
- Verification after transfer prevents integrity challenges.