/iblai-security-disk-forensics

Analyze disk images and file systems to recover evidence, reconstruct timelines, and identify artifacts.

Do NOT touch the original. Mount everything read-only. Never modify timestamps or content on source evidence.

Evidence Handling

• Work on copies, never originals.
• Verify image integrity with hash comparison before analysis.
• Mount read-only — every time.
• Log every command and finding.
• Preserve timestamps.

Step 1: Image Identification and Integrity

Identify the format and confirm integrity: