performing-disk-forensics-investigation

name	performing-disk-forensics-investigation
description	Conduct disk forensics investigations using forensic imaging, file system analysis, and timeline reconstruction, with tools such as FTK Imager, Autopsy, and The Sleuth Kit, for evidence acquisition, deleted file recovery, and artifact examination. Use when a security incident requires forensic analysis of persistent storage or when evidence must be preserved for legal or HR proceedings.
domain	cybersecurity
subdomain	incident-response
tags	["disk-forensics","forensic-imaging","evidence-acquisition","file-recovery","chain-of-custody"]
mitre_attack	["T1486","T1490","T1070","T1078","T1005"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Performing Disk Forensics Investigation

When to Use

• A security incident requires forensic analysis of a system's persistent storage
• Evidence preservation is needed for potential legal proceedings or HR investigations
• Deleted files, browser history, or application artifacts must be recovered
• A timeline of user or adversary activity must be reconstructed from file system metadata
• Malware persistence mechanisms stored on disk need identification and documentation

Do not use for volatile evidence (running processes, network connections); use memory forensics with Volatility instead.

Prerequisites

• Forensic workstation with write-blocking hardware or software (Tableau T35u, Arsenal Image Mounter)
• Forensic imaging software: FTK Imager, Guymager, or dd with dcfldd
• Analysis platform: Autopsy, FTK (Forensic Toolkit), or X-Ways Forensics
• Sufficient storage (2-3x the target drive size for image plus working copies)
• Chain of custody forms and evidence bags for physical media
• Hash verification tools for evidence integrity (SHA-256)

Workflow

Step 1: Secure and Document the Evidence

Before touching any storage media, establish chain of custody:

• Photograph the system, noting serial numbers, labels, and cable connections
• Document the evidence source: device type, make, model, serial number, capacity
• Complete chain of custody form with date, time, handler name, and reason for acquisition
• Use a hardware write blocker when connecting the evidence drive to the forensic workstation

Chain of Custody Record:
━━━━━━━━━━━━━━━━━━━━━━━
Case ID:          INC-2025-1547
Evidence ID:      EVD-001
Description:      Samsung 870 EVO 500GB SSD
Serial Number:    S5XXNJ0R912345
Source Host:      WKSTN-042
Acquired By:      [Analyst Name]
Date/Time:        2025-11-15T16:30:00Z
Write Blocker:    Tableau T35u (S/N: T35U-12345)

Step 2: Create a Forensic Image

Produce a bit-for-bit copy of the evidence drive:

Using FTK Imager (Windows):

1. Connect evidence drive through write blocker
2. File > Create Disk Image > Select source drive
3. Choose E01 (Expert Witness Format) for compression and metadata
4. Set destination path and evidence item information
5. Enable "Verify images after they are created"
6. Record source and image hash values

Using dcfldd (Linux):

# Create raw image with hash verification
dcfldd =/dev/sdb of=/evidence/WKSTN-042. \
  =sha256 hashlog=/evidence/WKSTN-042.sha256 \
  bs=4096 conv=noerror,


 /evidence/WKSTN-042.