Disk image analysis (Digital forensics)
Disk image file analysis is the process of examining a digital copy of a storage device (like a hard drive, SSD, USB drive, or CD/DVD) for forensic, troubleshooting, or recovery purposes. Disk image files are exact replicas of the entire contents of a storage medium, including all files, directories, and metadata, captured at a specific point in time. These files are commonly used in digital forensics, data recovery, and system deployment.
Scenario-
In a company, an employee was suspected of using their office laptop for personal work without prior authorization. During a routine audit conducted on a random day, a folder was discovered on Satish's laptop that did not appear to be related to office work. This raised suspicions, prompting the forensic team to investigate the contents of the folder, including any deleted files.
Given the suspicion that the folder might have contained deleted or hidden data, a partial acquisition of the disk focusing on the folder was performed. The forensic analyst created a disk image in the E01 (EnCase Evidence) format for detailed analysis. The image file was named "case.E01" to document the investigation systematically.
Pls Copy this link :- https://drive.google.com/drive/folders/1VFnyEjVfLmYW7ZBCaNT7JUNx58P8wc08?usp=drive_link
(open this link in the web browser)