Questions tagged [disk-image]

Questions involving files that contain a byte-for-byte copy of a storage medium such as a USB stick or a hard disk drive.

Filter by
Sorted by
Tagged with
0 votes
1 answer
200 views

How to create a hash file of a .dmg file for use in JTR?

I have a .dmg file on my MacBook. I have forgotten the password of the .dmg file and now I'm not able to access the files in it. I tried using John the Ripper. However, whenever I run john --format=...
ange1o's user avatar
  • 1
1 vote
1 answer
144 views

How to forensically check if some data on .vmdk disk has been hidden/deleted?

I was presented with a task. I have .vmdk disk available and I have to check its contents - forensically check the data on it without modifiying it and then check whether some data on this disk has ...
Nejc Ahtik's user avatar
2 votes
0 answers
383 views

MMLS (Sleuth Kit) not working in some situations

I am experiencing some issues when using mmls command after having created an image with dcfldd/guymager in some particular situations. Usually this approach seems to be working fine to create ...
Luca Domeneghetti's user avatar
1 vote
1 answer
200 views

How to make a virtual machine forensics-proof - completely or to the maximum possible level?

I want to make a VMWare (VMWare is first preference but any alternative can be used as well) virtual machine completely digital forensics-proof. I am protecting against someone getting physical access ...
Shy's user avatar
  • 121
1 vote
0 answers
144 views

How is PlayStation (4/5) protected from disk-copying piracy?

It just doesn't make any sense to me. Any owner of a original PS game disk has full access to it, so it shouldn't be a problem to create an identical disk, isn't it? And PS won't be able to tell apart ...
kandi's user avatar
  • 111
1 vote
2 answers
900 views

Clonezilla for forensic disk image

I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine. Since some of the commercial products are very expensive I'm turning to open source ...
Jack's user avatar
  • 11
1 vote
1 answer
323 views

Can M.2 docking stations be used to make forensic images of (Bitlocker encrypted) M.2 disks?

I am looking into M.2 docking stations such as the Maiwo K3016S as shown below. Is it possible to use such docking stations optionally in combination with a USB- or software write-blocker, in order ...
Bob Ortiz's user avatar
  • 6,661
3 votes
3 answers
4k views

Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image?

I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external ...
Bob Ortiz's user avatar
  • 6,661
0 votes
0 answers
125 views

Wiping a hard large hard drive efficiently but securely step by step

I want to sell my old 4TB Hard Drive. Of course I want no one to steal my data. Overwriting the whole drive with zeros with dd if=/dev/zero of=/dev/sda would take about 18h. But I cannot reboot my PC ...
dfsg76's user avatar
  • 549
0 votes
1 answer
336 views

Is it safe to extract file from potentially infected disk

I have a hard drive used for years, there are windows and many personal files on it. What I called "files" are images, musics, documents (pdf or docx), but not programs. All the "files&...
Tindera's user avatar
0 votes
0 answers
120 views

Destroying data on storage drives via overwrite methods really doesn't work?

I'm going to sell a computer hard drive on the Internet, it's a 500GB SATA hard drive, I really used it 3 or 2 years ago, I never used it again, I used about 20 or 40% of the space. I have read about ...
Julián's user avatar
  • 249
0 votes
3 answers
1k views

Why after dd'ing ISO file to entire USB flash device, only the first partition match the ISO checksum? [closed]

I use dd to "burn" an ISO file to USB stick: dd bs=4M if=/mnt/media/ISO/Fedora-Workstation-Live-x86_64-31-1.9.iso of=/dev/sdd conv=fdatasync status=progress Now I can see several partitions has ...
Alex's user avatar
  • 103
1 vote
0 answers
135 views

How long would traces of a disk wipe be visible? [closed]

If a user on normal everyday-use computer wiped the unallocated space on a hard disk drive, how long would it take before analysis of the unallocated space would yield no evidence of a disk wipe? Lets ...
another_stack_user999's user avatar
1 vote
0 answers
85 views

OSX: Momentary appearance of a .dmg modal, when opening an image

I had a situation that struck me as odd. I opened an image which I had downloaded via browser save-as. After the finder/OS initiated the file-open, a modal dialog momentarily flashed, typical to ...
New Alexandria's user avatar
2 votes
1 answer
3k views

How to do forensis MBR hex dump?

I take OS first 512 hexdump using dd command. what kind of information extract using that and what are the tools or command(linux) can be used for analysis ? I take copy bytes dump using my Ubuntu ...
uma's user avatar
  • 183
0 votes
1 answer
179 views

Could an infected .iso file infect a PC that is running a disc burning or drive imaging program?

I can't seem to find too much on this, but I'm worried after realizing I downloaded my Raspbian image from HTTP, and wrote it into a USB stick without verification. I'm worried, especially since I ...
RoundDuckMan's user avatar
2 votes
1 answer
1k views

What options are there to clone or image a disk to an encrypted drive?

To ensure that cloned or image disks remain secure and are not accessible by others, there is a requirement to have these stored on encrypted drives. When attempting to use tools such as Macrium ...
Motivated's user avatar
  • 1,513
6 votes
2 answers
4k views

Is it possible to take an image of the firmware of HDD and SSD?

I suspect that both my HDD and SSD may be infected. Is it possible to take an image of the firmware? How do I go about doing it?
ssdhddinfected's user avatar
0 votes
1 answer
648 views

Will re-imaging kill ransomware?

Pretty much what the title suggests. I understand its quite vague so apologies. I'm just not sure if it's able to install something that will sit elsewhere on the machine (as in not on the C:) which ...
Lelantos's user avatar
  • 329
2 votes
1 answer
1k views

Integrity of an SSD forensic image

Is there any solution to validate the integrity of an SSD image? If I know well in case of SSD low level disk maintenance stuff such as wear leveling is performed inside the drive in order to ...
Richard Leonard Kirner's user avatar
6 votes
1 answer
391 views

Integrity of LIVE forensic evidences (e.g. memory dump)

I'm wondering how can I prove the integrity of a computer forensic evidence which was obtained from a running machine (e.g.: memory image). As soon as I do anything with that box, connect a pendrive ...
Richard Leonard Kirner's user avatar