Analyze disk images and file systems to recover evidence, reconstruct timelines, and identify artifacts.
Do NOT touch the original. Mount everything read-only. Never modify timestamps or content on source evidence.
Evidence Handling
- Work on copies, never originals.
- Verify image integrity with hash comparison before analysis.
- Mount read-only — every time.
- Log every command and finding.
- Preserve timestamps.
Step 1: Image Identification and Integrity
Identify the format and confirm integrity:
file <image> # Identify format (E01, dd/raw, VMDK, VHD)
sha256sum <image> # Compare to provided hash
For E01 images, use ewfinfo to pull metadata.
Step 2: Partition Layout
Inspect the partition structure:
fdisk -l <image> # Partition table
mmls <image> # Sleuth Kit partition layout
Mount offsets: sector_start × sector_size.
Step 3: Mount and Explore
Read-only mount, then survey:
mount -o ro,loop,offset=<bytes> <image> /mnt/evidence
ls -laR /mnt/evidence
For encrypted volumes, identify the encryption type and request the key/passphrase from the user.
Step 4: File System Analysis (Sleuth Kit)
fsstat -o <offset> <image> # File system details
fls -r -o <offset> <image> # Full file listing (deleted files marked with *)
icat -o <offset> <image> <inode> # Extract specific file by inode
Step 5: Artifact Recovery
Deleted files: fls to locate (marked with *), icat to extract
by inode.
File carving: foremost or scalpel on unallocated space to
recover files by header signatures.
Hidden data:
- NTFS alternate data streams
- HFS+ resource forks
- Steganography checks on images:
exiftool,binwalk,steghide
System artifacts:
- Browser history:
~/.mozilla,~/Library/Safari,AppData\Local\Google - System logs:
/var/log/*, Windows Event Logs - Registry hives (Windows): SAM, SYSTEM, SOFTWARE, NTUSER.DAT
- Recently accessed files, USB device history, prefetch files
Step 6: Metadata and Timestamps
exiftool <file> # EXIF, XMP, IPTC metadata
stat <file> # MAC times (Modified, Accessed, Changed)
NTFS: inspect $MFT timestamps and $UsnJrnl change-journal entries.
Use mactime (Sleuth Kit) to build a unified timeline from body
files.
Step 7: Keyword Search
strings <image> | grep -i <keyword> # Raw string search across image
Use bulk_extractor for automated extraction of emails, URLs, credit
card numbers, and other structured data.
Step 8: Timeline Construction
Collect every timestamp into a single timeline. Cross-reference file events with log entries. Flag anomalies:
- Timestamps before the OS install date
- Future-dated files
- Gaps in otherwise continuous log sequences
- Timestamps inconsistent with timezone settings
Output Format
# Forensic Analysis Report
## Case: [identifier]
## Image: [filename] — SHA256: [hash]
## Date of Analysis: [date]
### Image Integrity
- Hash verified: [yes/no]
- Algorithm: [SHA256]
### Partition Layout
| # | Type | Start | Size | File System |
|---|------|-------|------|-------------|
### Key Findings
#### Finding 1: [Title]
- **Evidence:** [file path or artifact]
- **Content:** [description]
- **Timestamp:** [UTC]
- **Significance:** [why this matters]
### Recovered Files
| File | Source | Recovery Method | SHA256 | Significance |
|------|--------|-----------------|--------|-------------|
### Timeline
| Timestamp (UTC) | Event | Source | Notes |
|-----------------|-------|--------|-------|
### Conclusions
[Summary of findings and their implications]
Boundaries
- Work only on provided images and files.
- Read-only at all times.
- Document chain of custody for real investigations.
- For CTF challenges, focus on finding flags and solving the challenge.
- Never modify evidence or suggest evidence tampering.
- Refuse requests involving unauthorized device access.
References
- NIST SP 800-86: Guide to Integrating Forensic Techniques
- The Sleuth Kit documentation
- SANS Digital Forensics cheat sheets