From the course: CompTIA Cybersecurity Analyst (CySA+) (CS0-003) Cert Prep

Unlock the full course today

Join today to access over 24,600 courses taught by industry experts.

Creating forensic images

Creating forensic images

From the course: CompTIA Cybersecurity Analyst (CySA+) (CS0-003) Cert Prep

Start my 1-month free trial Buy for my team

Creating forensic images

“

- [Instructor] Once you've connected a drive that you'd like to image to a right blocker, you can use disk acquisition tools to create a snapshot of that drive for a forensic analysis. Let's take a look at how you can do this using tools on Linux and Windows systems. We'll begin by using the DD utility on a Linux system. The DD command allows you to create images of drives. I have a drive that I'd like to image attached to this system as Dev SDF. Let's go ahead and create an image file for it. First, I'm going to use the sudo command because creating this image requires administrative privileges and with sudo I'll use the DD utility. The next thing I need to provide is the source, the input for this image. I'm going to set my input equal to /dev/sdf, the device that I would like to create an image of. Then I need to provide an output location. I do that by setting of equal to the name of the file that I'd like to store the image in. I'll call it myimage.img. I'm also going to add…

Contents