Performing Disk Forensics Investigation

When to Use

• A security incident requires forensic analysis of a system's persistent storage
• Evidence preservation is needed for potential legal proceedings or HR investigations
• Deleted files, browser history, or application artifacts must be recovered
• A timeline of user or adversary activity must be reconstructed from file system metadata
• Malware persistence mechanisms stored on disk need identification and documentation

Do not use for volatile evidence (running processes, network connections); use memory forensics with Volatility instead.

Prerequisites

• Forensic workstation with write-blocking hardware or software (Tableau T35u, Arsenal Image Mounter)
• Forensic imaging software: FTK Imager, Guymager, or dd with dcfldd
• Analysis platform: Autopsy, FTK (Forensic Toolkit), or X-Ways Forensics
• Sufficient storage (2-3x the target drive size for image plus working copies)
• Chain of custody forms and evidence bags for physical media