Practical Windows Forensics

Linux for the imaging of a hard drive

Suppose that you already have a dead system and you need to take the machine's hard drive out in order to image it. What you need to do first is make sure that you are connecting the hard drive to your preferred Linux machine via write blocker to prevent any accidental writing to the hard drive, which could change the evidence and make it inadmissible.

The dd tool

In the Linux operating system, there is a built-in tool called dd. The dd tool is considered to be a forensically sound tool, as it copies blocks of data, regardless of its structure. There are a lot of suggestions of what dd stands for, but we can say that dd stands for duplicate disk or duplicate data, and if someone used it in wrong way it can be ...