1. Making image with Kali Linux

1.1 Description

The first step of the incident response is to image the suspicious system and get the hash of the

DD image, which can prove the status of the suspicious system don’t get any modifications. Keep in mind that the less changes on the suspicious system, the better.

1.2 Requirement

1) USB sticker, 8GB or greater. It will be used to boot the system with a customized Linux to make the image.

2) USB External hard drive. Recommend 1TB or greater. It will be used to save the image.

3) Download Kali ISO (https://www.kali.org/docs/introduction/download-official-kali-linux-images/ )

4) Rufus 3.8 or later (https://rufus.ie/)

1.3 Make a bootable USB Sticker with Kali Linux

1) On a test laptop (not the suspicious laptop), download Kali Linux ISO from https://www.kali.org/get-kali/#kali-bare-metal, make sure you select the correct version.

2) Download Rufus from https://rufus.ie/

3) Insert the USB sticker. Run Rufus, select the device and ISO file (Boot selection), leave other options as default setting. Click “Start” button to start making the bootable USB.

1.4 Make DD image of the suspicious system

1) Make the suspicious computer sleep or shut it down as soon as possible to maintain the environment.

2) Find out how to boot from a USB Stricker on the suspicious laptop. Different laptop might have different methods.

3) Attached the Kali Linux USB sticker and boot the suspicious system from it.

4) On the “Boot menu”, select “Live (forensic mode)”. This option is going to run the Kali without installing.

5) Attach the external USB hard disk. The image will be saved on it.

6) Open the “Terminal Simulator”.

7) Run the following command

# sudo su

# fdisk -l

# dd if=/dev/nvme0n1 of=/media/kali/Fast_External/myimage.img bs=65536 conv=noerror,sync

Note: In this example, the computer’s disk name is “nvme0n1” and the name of external USB Hard Disk is “Fast_External” change these points according to the result of fdisk command.