Information Security

Questions tagged [disk-image]

Ask Question

Questions involving files that contain a byte-for-byte copy of a storage medium such as a USB stick or a hard disk drive.

7 questions
Info Newest Frequent Votes Active Unanswered
1
vote
0answers
59 views

How to do forensis MBR hex dump?

I take OS first 512 hexdump using dd command. what kind of information extract using that and what are the tools or command(linux) can be used for analysis ? I take copy bytes dump using my Ubuntu ...
0
votes
1answer
57 views

Could an infected .iso file infect a PC that is running a disc burning or drive imaging program?

I can't seem to find too much on this, but I'm worried after realizing I downloaded my Raspbian image from HTTP, and wrote it into a USB stick without verification. I'm worried, especially since I ...
2
votes
1answer
61 views

What options are there to clone or image a disk to an encrypted drive?

To ensure that cloned or image disks remain secure and are not accessible by others, there is a requirement to have these stored on encrypted drives. When attempting to use tools such as Macrium ...
6
votes
2answers
227 views

Is it possible to take an image of the firmware of HDD and SSD?

I suspect that both my HDD and SSD may be infected. Is it possible to take an image of the firmware? How do I go about doing it?
0
votes
1answer
173 views

Will re-imaging kill ransomware?

Pretty much what the title suggests. I understand its quite vague so apologies. I'm just not sure if it's able to install something that will sit elsewhere on the machine (as in not on the C:) which ...
2
votes
1answer
610 views

Integrity of an SSD forensic image

Is there any solution to validate the integrity of an SSD image? If I know well in case of SSD low level disk maintenance stuff such as wear leveling is performed inside the drive in order to ...
4
votes
1answer
203 views

Integrity of LIVE forensic evidences (e.g. memory dump)

I'm wondering how can I prove the integrity of a computer forensic evidence which was obtained from a running machine (e.g.: memory image). As soon as I do anything with that box, connect a pendrive ...