Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

The BitCurator environment includes Guymager, an open-source, graphical application for creating disk images. Guymager has support for raw dd images, EO1, and AFF image formats. The latter two image formats are commonly used in the digital forensics community and have the ability to incorporate metadata about the original media into the disk image itself.

Step-by-step guide

  1. Create a directory in which to store your disk image by opening up Nautilus (the "Home" folder on the top left-hand side of the screen) and right clicking anywhere on the white background. Select "Create New Folder" from the drop-down menu. Name the folder as you see fit; we will use the folder name "diskimages" in this example.
  2. Make sure to safely mount the device, enable read-only enforcement, and/or use a write blocker in order to prevent inadvertently writing data back to the disk. The BitCurator environment is set up to enforce read-only access by default.

    Connect the device you wish to image to your computer (USB flash drive, CD-ROM, hard drive, or floppy disk drive). 

Note: A device does not need to be mounted in order to be imaged by Guymager, and BitCurator will not mount devices automatically (the icon that appears in the Unity bar on the left indicates that the device is attached, rather than mounted). If you need to examine the contents of the disk before creating the disk image, you can safely mount the device. Simply clicking on the device icon will safely mount (in read-only mode) the readable filesystem(s) on that device.

  • No labels