Analyzing Disk Images

A disk image is a frozen crime scene, and the whole discipline is preserving that. Work only from a verified, read-only copy, prove nothing changed with hashes at every step, and remember that the deleted and the unallocated often say more than the live file system — because that is exactly what someone tried to remove.

When to Use

• You have an acquired disk image (.E01, .dd/.raw, .aff4, .vmdk, .vhdx) to examine
• Recovering deleted files, or reconstructing what was on a wiped or reformatted volume
• Building a file-system timeline or a full super-timeline across the whole image
• Carving files and artifacts out of unallocated space, slack, and free clusters
• Mining registry hives, browser data, logs, or other artifacts offline from a mounted image
• Confirming or refuting anti-forensics — timestomping, wiping, hidden or encrypted containers

When NOT to Use