DIGITAL FORENSICS: Using ProDiscover’s Raw Acquisition Format
ใช้โปรแกรม ProDiscover Forensics ทำสำเนาหลักฐานดิจิทัล เป็น Raw Image Format (DD)
![]() |
ProDiscover Computer Forensics Software |
Note: For actual casework, however, always use a write-blocker.
Step 1
On workstation device, start ProDiscover from desktop.
Click Action and select Capture Image. Source drive will be USB (E:) drive.
![]() |
Capture Image. |
Step 2
Follow the steps in this chapter for making a raw format acquisition, making sure you click UNIX style dd format in the Image Format drop-down list box. Assign a unique file name for the image file.
![]() |
Source drive will be USB (E:) drive. |
Step 3
Then click OK in the Capture Image dialog box.
Click Proceed when you get the WARNING message.

Preceed

Step4
When the acquisition is finished, click OK.
Step5
Check MD5
![]() |
MD5 |
![]() |
Image File CF-DFE-001.DD |
No comments:
Post a Comment