We help IT Professionals succeed at work.

Forensic image of Hard drive

Max Haptonstahl
Max Haptonstahl used Ask the Experts™
I need to make a forensic image of each HDD of a group of our employees' desktop computers; I need the same for their smartphones. What equipment and/or software do I need to makes these images without removing the drives?
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Quid, Me Anxius Sum?  Illegitimi non carborundum.
EnCase  https://www.guidancesoftware.com/

If you are not removing the hard disks then EnCase Portable  https://www.guidancesoftware.com/encase-portable

They also make stuff for mobile phones as well.

If you are doing a forensic image for legal purposes then employ an authorised contractor for the job.  Their evidence will stand up in court.
btanExec Consultant
Distinguished Expert 2018

As mentioned by expert, and to highlight these forensically sound images must be a bit-by-bit, physical  copy of the device. Without such a copy, any evidence will likely be inadmissible in a court of law. Some also gotten a writeblocker physically to make acquisition is sound without taint on target source.

Dd or dcfldd are rudimentary tool for creating forensically sound device images. Mostly only for non Windows, no GUI, but fast and straightforward.

There is another on FTKImager and MPE from AccessData
I was asked to do this for a client once, but stepped away after asking advice from the forensic expert at our local Police Department.  He acknowledged that while my methods were sound (either using a physical duplicator or bit-by-bit software duplicator), a competent attorney on the other side would likely be successful at challenging my expertise.  My complete lack of knowledge of how to testify in court would probably get my efforts tossed out.  Consider carefully what sort of challenge you may encounter.
There's also a little thing called chain of custody.
So if this is gonna go to court ,you're gonna have to document when and what you did along with how.
WakeupSpecialist 1
CRU Inc, makes some decent forensic tools as well as great support:

As stated above, the devices you will need/want also depends on how you want to acquire the data.

If you have access to the raw drive, there are many DOCKS available.  The important things to remember is that contamination is potentially a risk if you connect these drives to a unit that will access and write to the drive.  So as stated by some above, get a Write blocker.

Also as stated by some, if this is new to you and you are not sure how the legal process works and what your forensic software and/or hardware does, then you could ruin your case.  Make sure you have a knowledgeable team.

As far as cell phones go I am not familiar with any devices/software in my professional knowledge.  I haven't delved into that.  Googling shows an array of stuff.  But I am not aware of what is legit and what works well.
WakeupSpecialist 1
I also added the category of 'Digital Forensics' for more visibility.
WakeupSpecialist 1

Is there some other questions you may have or that we can answer about this instance?
Max HaptonstahlIT Administrator


The best solution was more strategic than tactical. I appreciated the comments as to what software/hardware would help me, but the most practical advice was to engage a contractor who could fulfill forensic tasks that would hold up in court.
Thanks to Everybody! -Max
btanExec Consultant
Distinguished Expert 2018

The software options are to help in suggestion on what you asked - ".. equipment and/or software do I need to makes these images without removing the drives?" instead.
WakeupSpecialist 1

Just posting this link to another question on EE:

I found this to be interesting and potentially relevant from one of the accepted solutions:

Accepted Solution
Comment posted 2013-07-25
Comment Utility  

This document is a good start at identifying issues that surround investigations:

 The kinds of information you gather would serve to:
 identify the equipment
 maintain a chain of custody
 provide for authentication of the evidence
 ensure that nothing has changed since the evidence was collected (MD5 or SHA1 hash values as reported by the imaging tool)

 Digital forensic exams in general are well covered by the Department of Justice:
 One of the documents there even has sample reports:

 For the basics of imaging, AccessData's FTK imager tool is often used.
 Here is a video on how to use it, which could be used to help create documentation for your organization: http://www.youtube.com/watch?v=39f2WV-8SKg&list=TL14cEkMlzXEM