28. Introduction to Digital Forensics
28.4 Making and Verifying a Disk Image
Disk forensics cha pahila step: bit-for-bit image banavne (nusti file copy nahi – purna disk, deleted data sah).
# list disks (identify the evidence disk carefully!)
lsblk
# make a raw image with dd (or 'dcfldd'/'dc3dd' which also hash while imaging)
sudo dd if=/dev/sdb of=evidence.dd bs=4M status=progress
# better: image and hash in one step
sudo dc3dd if=/dev/sdb of=evidence.dd hash=sha256 log=evidence.log
# verify the image matches the source
sha256sum /dev/sdb evidence.dd
In real work you attach the evidence disk through a write blocker so imaging cannot alter it. For practice, image your own spare USB stick.
Double-check if= and of=
dd copies exactly what you tell it. Swapping if= (input) and of= (output) can wipe the wrong disk. Read the lsblk output carefully and confirm the device names before running.
Ravindra Bagale's Tip
dd la "disk destroyer" pan mhantat – ek chuk ani chukicha disk saf hoto! Aadhi lsblk ne exactly konta /dev/sdX te confirm kara, mag command chalava. Ghai madhe ha command chalavne mahagat padte.
Lab
On a spare USB stick you own, make an image with dd (or dc3dd), record its SHA-256, and verify the image hash matches the source. Keep the .dd file for the next section.