Skip to main content

Introduction

Revision History​

DateAuthorSummary
28-NOV-2022TSgt. BernadotteInitial draft
20-JUL-2023TSgt. BernadotteCombined "Disk Image Cloning" SOP with "Disk Image Mounting" SOP
22-APR-2025SSgt. ChongAdded "FTK Imager" SOP and updated "Introdution"

Purpose​

This SOP is intended to aid an operator in performing "dead disk" forensics with procedures for cloning and mounting disk images using the SANS SIFT VM.

Additionally, this SOP is intended to aid an operator in performing host baseline forensic imaging (e.g. memory dump and disk golden image via FTK Imager), not to be confused with baseline host collection/inventory via Metasponse Job Templates.

End-State​

Forensic "Dead Disk" Image Cloning​

  • A logical file (or physical) clone of the source block device (or partition) will be created and hashed to verify integrity
  • Partitions from a source block device will be mounted for filesystem analysis

FTK Imager​

  • Generated golden image of target Windows host(s), to be used for forensic analysis in the SANS SIFT VM, or "living of the land" threat hunt via hosting the golden image on VMWare Workstation.
  • Generated memory dump of target Windows host(s), to be used for forensic analysis in the SANS SIFT VM

Requirements​

  • SANS SIFT Workstation VM (Ubuntu version)
  • A destination disk/partition with free space equal to or larger than the source block device
  • If a physical/external destination disk is not being used, an additional VM disk must be added to the SANS SIFT Workstation VM and formatted + mounted
  • If mounting APFS filesystems from Apple devices, you will need to download and install the necessary software on the SANS SIFT Workstation VM as annotated within the corresponding section within this SOP
  • For physical devices - this SOP assumes that the source block device has already been removed from the computer
  • For physical devices – a write-blocker such as a Tableau T8U Forensic USB 3.0 Bridge for ensuring forensic soundness and preventing accidental modification of the source block device to maintain integrity
  • For physical devices – adapters for and connectors, depending on your source block device type:
    • SATA
    • mSATA
    • M.2 PCI-E
    • M.2 SATA
    • M.2 NVMe
    • IDE/PATA
    • SCSI
    • USB

Considerations​

  • The cloning destination may also be another physical block device (as opposed to a file) – which will be completely overwritten
  • Depending on the purpose of employing this SOP, it may not be necessary to clone the entire block device, but only targeted partitions (such as the system partition)
  • It is highly recommended to utilize a physical write-blocker in order to prevent accidentally modification of the source block device