Making Image of A Laptop (Summary)

1.      Summary

A Forensic image is an exact copy of the hard drive. The objective is to capture the image of a hard disk bit by bit without changing even a shred of data. It should also copy the deleted data, including files that are left behind in swap and free space.

 

There are 2 types of the making image of a suspicious system.

1)    Cold copy: The system will be booted from USB sticker or DVD. And run the imager tool from the customized Linux system.

2)    Hot copy: The system installs the imager tool to make the image.

 

It is recommended to use “Cold copy” because the less changes on the suspicious system, the better.

However, in some circumstance, it is not possible to get a cold copy, hot copy can be used. And hot copy can also capture the volatile memory for analysis purpose.

 

Below introduces 3 tools. The first 2 tools are for “Cold Copy” and the last tool is for “Hot Copy”.

1)    Paladin Edge 64 (https://andyinmatrix.blogspot.com/2021/03/making-image-of-laptop.html )

2)    Kali Linux (https://andyinmatrix.blogspot.com/2022/01/making-image-of-laptop-part-2.html )

3)    FTK Imager (https://andyinmatrix.blogspot.com/2022/01/making-image-of-laptop-part-3.html )