Showing posts with label Cyber Forensics Tools. Show all posts
Showing posts with label Cyber Forensics Tools. Show all posts

3 Ways to Mount a RAW Image in Windows

In Forensic, to investigate a hard drive or disks we always make a forensic image. A Forensic Image is a forensically sound and complete copy of a hard drive or other digital media, generally intended for use as evidence. Copies include unallocated space, slack space, and boot record.  Many computer forensic programs, especially the all-in-one suites, use their own file formats to store information. These images are stored in a format of RAW file or AFF or E01.

RAW Image Format: This format is a RAW bit-by-bit copy of the original. It is often accompanied by Meta data stored in separate formats. This Image Format is most common used and is read by every Forensic tool in the industry.

Once the RAW image is created, it can't be read unless it is mounted by a tool. Mount is the process that will take the raw logical image and mount it onto a specified directory of choice to be able to examine the contents of that image. The image has to include be a recognizable file system as a partition. This makes invocation of the command interesting as the raw image is a physical disk image and not a specific partition of a file system.

Mount an image for a read-only view that leverages to see the content of the image exactly as the user saw it on the original drive.


There are various methods to mount a RAW file. But before we learn how to mount our RAW files, just have look on your my computer so that you can have a idea about how many drives you have before mounting a RAW file. For instance, following is the image of my computer of my PC:


Now, Let us have a look on these methods :

Forensic Tool Kit Imager

FTK Imager (version - 3.4.2) is tool introduced by Access Data which is used to preview data. It is also an imaging tool that lets us acquire in a forensically sound way. FTK helps us to create forensic images, Mount an image for a read-only view, Create hashes of files, etc and right now we will focus on its Mount function. To mount a RAW image file via FTK, first of all download FTK from --> http://accessdata.com/product-download/digital-forensics/ftk-imager-version-3.4.2
Now that FTK is downloaded and installed, open it and click on Files on the menu bar. A drop down menu will appear, from this menu click on Image Mounting.



A dialogue box will open now. Give the path of RAW file in Image File option and click on Mount button.


Once you click on Mount button your image will be mounted and you can see result in Mapped images:


OSFMount
OSFMount (version - 1.5.1015) is software by PassMark Software’s. It helps you mount your image files even your hard disk image file in windows with a drive letter. You can then analyze the disk image files further. For your original files not to be altered, the image files are mounted as read only by default. Download this software from --> http://www.osforensics.com/tools/mount-disk-images.html

Open OSFMount after the instalation is completed open it:


Go to File menu and select Mount new virtual disk option.


Dialogues will open; here give the path of your image file under the heading Image file and click on OK.


You can see in the following image that your RAW image will be mounted as a result:


Mount Image Pro
Get Data is a software development company that has launched Mount Image Pro (version - 6). It is a computer forensic tool which enables us to mount an image for forensic purpose. You can download this software from http://www.mountimage.com/
Open the software after its installation.


Go to File menu and click on Mount Image File.


A dialogue box will open and select your image file from it.


And then another dialogue box will open informing you with all the details. Click on OK.


It will further show you the progress in another dialogue box.


And as the outcome you can see that your image file will mount as shown in following image:



Now, as i had asked you to check you’re my computer before mounting the image, similarly, you can again check my computer and you will an extra drive as shown below:

Forensic Investigation of Any Mobile Phone with MOBILedit Forensic

With MOBILedit Forensic you can view, search or retrieve all data from a phone with only a few clicks. This data includes call history, phonebook, text messages, multimedia messages, files, calendars, notes, reminders and raw application data. It will also retrieve all phone information such as IMEI, operating systems, firmware including SIM details (IMSI), ICCID and location area information. Where possible MOBILedit Forensic is also able to retrieve deleted data from phones and bypass the passcode, PIN and phone backup encryption.

Note: USB Debugging must be enabled.

Download the MOBILedit!  Forensic from here & Install on your PC. Now Click on MOBILedit! Forensic.

Click on Connect Option. MOBILEedit! Forensic Wizard will run and ask for Phone, Data file or SIM Card. Select Phone Option.  Click on Next.



Now it will ask for type of connection. Select Cable Connection. And click on Next.


Now follow the instructions such as install Driver or turn on USB debugging if connecting Android.
Now connect the phone via data cable. If prompted choose connection mode to PC Sync or COM port. Click on Next Option.


It will show the connected mobile. Check your Mobile model and click on Next.


To take the Backup, first of all enter Owner Name, Device Evidence Number and Owner Phone Number.
Click on Browse Option to select the path folder where backup data will be stored and click on Next.


Now it will ask for part of file system to   backup. Choose Whole File System or Specified File Types such as Audio, Video or pictures. Then Click on Next.


Now it will show the progress bar for Back Up and after completion click on Next.


Now select the check box for Phone memory extraction and click on Next.


Now it will show the message for creation of memory dump on memory card file. Click on Next.


Now select the group….Cases   to organize device data or click on   <New Case > to create new case and click on Next.


If we have selected New Case Option, then it will ask for Case Number and investigator details .Enter
 Investigator Details and click on Next.


Now select the Template for Data Export and Click on Finish.


Now select the Template for Data Export and Click on Finish.


Now it will show the generated Forensic Report.


Select Connected Device Option.


Now it will generate a report with all the details such as Phone book, Call logs, messages, Files etc.


To get phone book details, select Phone book option.


Now you can select sub option such as WhatApp to see WhatsApp Messages.


Click on Call Logs to see Missed Calls, Outgoing calls and Incoming calls.


Now Click on Messages to see all received, sent and draft messages.


Click on Application Data to get all the details about content providers.


Click on Application to see all the installed Apps in Mobile.


Select Files Option to see all the details about system files in Mobile.


Now Click on Media and select internal media or user media and then select pictures option to see Pictures.


To view User‘s Files, Click on Option User Files.

Android Mobile Device Forensics with Mobile Phone Examiner Plus

AccessData (AD) Mobile Phone Examiner Plus (MPE+) is a powerful mobile device data review tool that can be used in the field as part of a mobile field unit or in the lab. Additionally, data extracted from mobile devices using MPE+ can be easily imported into an FTK case, which offers more in-depth drill-down, categorization, full-text index searching, and all of this is right alongside other digital evidence collected for a case. MPE+ can extract information such as phone and address book data, media files, call logs, SMS and MMS messages, calendar, and file system data stored in the memory of a mobile device.

Download MPE+ from here & install in your PC.


Now Double click on MPE+ Icon to open it.


Note: USB Debugging must be enabled.

Now select the Drive Management option from Home tab.

To install the mobile driver in your system, click on download option from the given list.
It will install the driver. Click on Select Device.


Now enter the Manufacturer and Model No of the mobile. Click on Connect.


Now select the mobile android version and click on finish.


It will display a message. Connecting to Android Device.


Now it will show the Select Data for Extraction Pop Up. Click on Select All Option and select Extract Option.



It will show the Progress Bar for Android Logical Device Data Extraction.


Now click on Device Information, it will show all the details about the Android Mobile.


 Select Call History Option to see all incoming and outgoing call details with duration as well as date and time.



To view all the contacts in the mobile, select Contacts option.


To get all the SMS messages, Select SMS Option.


To see how many android packages have been installed, select Android Packages.


To see all the connected Bluetooth devices, click on Bluetooth Devices Option.


To get the information about the WIFI connections connected with this android mobile, select WiFi Hotspots.


To see the bookmarks, click on WEB option and then select Bookmarks Sub option.


To get Browser History, Click on Web Option and select Browser History Sub option.


To see all the images existing in the Android Mobile from different resources, select Media option and click on Image Sub option.


To get the information about all video files, Select Video sub option from Media Option.