Practical Mobile Forensics - Third Edition

Imaging a memory (SD) card

There are many tools available that can image a memory card. The following example uses WinHex to create a raw disk image of the SD card. The following is a step-by-step process with which to image a memory card using WinHex:

• Connecting the memory card: Remove the SD card from the memory slot and use a card reader to connect the memory card to the forensic workstation.
• Write protect the card: Open the disk using WinHex. Navigate to Options | Edit Mode and select Read-only mode=(write-protected mode), as shown in the following screenshot. This is to make sure that the device is write protected and no data can be written on it:

WinHex view of Edit Mode (left) and WinHex Read-only Mode enabled (right)

• Calculating ...