Digital Forensic:CompTIA Cybersecurity Analyst (CySA+)

• Cyber-Incident Response: Summarize the incident recovery and post-incident response process

Domain 3: Cyber Incident Response

• Phases of an incident response
• Creating an incident response team
• How to classify an incident
• Analyzing network events
• Basics of Digital Forensics

Exam objec tives covered in this

chapter :

✓✓ 3.1 Given a scenario, distinguish threat data or behavior

to determine the impact of an incident.

■■ Threat classification

■■ Factors contributing to incident severity and prioritization

✓✓ 3.2 Given a scenario, prepare a toolkit and use

appropriate forensics tools during an investigation.

■■ Forensics kit

■■ Forensic investigation suite

✓✓ 3.3 Explain the importance of communication during the

incident response process.

■■ Stakeholders

■■ Purpose of communication processes

■■ Role-based responsibilities

✓✓ 3.4 Given a scenario, analyze common symptoms to select

the best course of action to support incident response.

■■ Common network-related symptoms

■■ Common host-related symptoms

■■ Common application-related symptoms

✓✓ 3.5 Summarize the incident recovery and post-incident

response process.

■■ Containment techniques

■■ Eradication techniques

■■ Validation

■■ Corrective actions

■■ Incident summary report

Lab Exercises

Create a Disk Image

In this exercise you will use dd to create a disk image and then verify the checksum of

the image.

Part 1: Boot a Kali Linux system and mount a drive

1. Start your Kali Linux virtual machine.

2. Select a USB thumb drive that is formatted as FAT32 to make an image of for this

practice session. A smaller drive will be faster to image, and you should make sure you

image a drive smaller than the space you have available for your Kali Linux system.

3. In the Devices menu for the running Kali virtual machine, select USB and then the

drive you have inserted. The device should now show up on your Kali Linux desktop.

4. Verify that you can navigate to the drive from the command line. Open a terminal

window, then navigate to /dev/disk/by-label, and make sure you see the name of the

thumb drive you have mounted.

Part 2: Clone the drive

1. Create a temporary working directory for your volume by running

mkdir ~/tmp

in your terminal window. This will create a directory called tmp in your home

directory.

2. Create an MD5 checksum of the volume you intend to clone in your home directory:

md5sum /dev/disk/by-label/[label of your drive] > ~/exercise7_1_original.md5

MD5= 027bcfd18c10718550b9dae5adfa0208

DD

• Standard Linux and UNIX tool
• Can clones drives using bit-by-bit copy

3. Clone the volume or disk:

dd if=/dev/disk/by-label/[label of your drive] of=~/tmp/exercise7_1_disk.img bs=64k

4. Once this completes, verify the integrity of the image using MD5:

md5sum ~/tmp/exercise7_1_disk.img > ~/exercise7_1_clone.md5

5. Now compare the MD5 files. You can do that by using the more command to view the

files, or you can record the values here:

MD5= 027bcfd18c10718550b9dae5adfa0208

DD command

Refer: CompTIA CySA+ Practice Tests: Exam CS0-002, 2nd Edition

           CompTIA CySA+ Study Guide Exam CS0-002 2nd Edition

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #computerforensic #ComputerForensics #dfir #forensics
#digitalforensics #investigation #cybercrime #fraud

Digital Forensics:Forensic Imaging with DD command

Forensic Imaging with DD command

Using the DD (Dataset Definition) command is a foundational skill in digital forensics for creating Bit-stream Images. This process ensures that every single bit—including deleted files and unallocated space—is captured for analysis.

Step 1: Identify the Source and Destination

Before running any commands, you must identify the correct drive identifiers to avoid the "Data Destroyer" accidental overwrite.

1.List all block devices:

lsblk

2.Verify drive details (Size, Model):

Source: /dev/sdb (The suspect's drive)

Destination: /dev/sda (Your forensic workstation's storage)

Step 2: Prevent Data Overwriting (Write-Blocking)

ISO/IEC 27037

Option A: Hardware Write-Blocker (Recommended)

Use a physical hardware write-blocker (like Tableau or WiebeTech) between the suspect drive and your workstation. This is the gold standard in forensics.

Photo by Gemini (Last update March 2026)

Option B: Software Write-Block (Forensics Mode) 

Step 3: Execute the Forensic Image (dd)

sudo dd if=/dev/sdb of=/evidence/suspect_drive.dd bs=4K  conv=noerror,sync

Command Breakdown:

• if=/dev/sdb: Input File (The source evidence).

• of=...: Output File (The destination image file).

• bs=4K: Block Size. 4KB is generally efficient for modern drives.

• conv=noerror,sync:

  • noerror: Instructs dd to continue if it hits a bad sector (crucial for damaged drives).

  • sync: Pads any bad sectors with zeros to keep the image size identical to the source.

  • 

Step 4: Integrity Verification (Hashing)

Per RFC 3227, you must prove that the copy is identical to the original. We use cryptographic hashes (SHA-256) to create a "digital fingerprint."

1. Hash the Source Disk:

sudo sha256sum /dev/sdb > source_CF005.txt

    2.Hash the Forensic Image:

sha256sum suspect_drive.dd > image_CF005.txt

Compare: If the strings in both .txt files match, your evidence is verified and admissible.

Summary of Standards Reference

• ISO/IEC 27037: Focuses on the "Digital Evidence First Responder" role—emphasizing write-protection and identification.

• NIST SP 800-86: Provides the technical framework for the "Collection" phase—ensuring the data is captured as a complete bit-stream.

dd – Linux Command คำสั่ง backup ข้อมูลใน harddisk ในทาง digital forensics ใช้คำสั่ง DD ในการทำสำเนาหลักฐาน Forensic Imaging

 คำสั่ง

dd if=<source file name> of=<target file name> [Options]

• if=<source> – กำหนดตำแหน่ง directory ต้นทางที่ต้องการ Forensic Image ข้อมูล โดย “if” คือ input-file
• of=<destination> –กำหนดตำแหน่ง file ปลายทางที่ต้องการ  Image file ทำการเขียนข้อมูลลงไป โดย “of” คือ output-file

1. ทำการ clone hardisk จากลูกหนึ่งไปอีกลูกหนึ่ง
dd if=/dev/sda of=/dev/sdb

2. ทำการ backup partition ที่ต้องการ ไปยัง file ที่กำหนด
dd if =/dev/sda2 of=~/hdadisk.img

3. ทำการ restore จาก Image file

dd if=hdadisk.img of=/dev/sdb3

4.  คำสั่งลบข้อมูล (WIPE Disk) บน Harddisk

dd if=/dev/zero of=/dev/hda bs=4K conv=noerror,sync 

5.  Hash > Hashing the evidence for integrity checking

sha1sum /dev/hda | tee ForensicImage_sha1.txt 
md5sum /dev/hda | tee ForensicImage_md5.txt

6. example 
dd if=/dev/hda bs=4K conv=sync,noerror | tee ForensicImage.img | md5sum > ForensicImage.md5

 เมื่อทำ ForensicImage แล้ว ควรทำการ hash ไฟล์ข้อมูลทุกครั้งด้วย md5 หรือ SHA-1  

DD command

ที่มา:

saixiii

www.forensicswiki

howtoforge

packtpub

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น

* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ

#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud