Digital › Module 3 › Lesson 1
Imaging Named
Disk imaging names bit-for-bit copies of storage — understand E01/aff/dd concepts on YOUR $DFIR_LAB; never image unauthorized devices.
Visual · t26_imaging_named
Imaging literacy. $DFIR_LAB only. Original Cyberlium.
Opening
An image is a container for sectors — literacy means naming formats and scope, not cloning stranger laptops.
Forensic imaging creates a verifiable copy of storage media: raw (dd), EWF/E01 (EnCase-style with metadata and optional compression), AFF, and VM disk files (VMDK/VHDX) when scope allows. Images are analyzed on write-protected mounts — originals stay sealed per policy. Cyberlium names imaging concepts on YOUR $DFIR_LAB practice targets — course E01 files, self-created VM disks — not hardware you lack authority to touch. Next: Hashing Integrity.
1. Image formats (named)
Raw/dd: simple sector stream, widely supported. E01: segment files, case metadata, compression — common in training datasets. VM disks: snapshot/copy of virtual disk when VM is yours or course-provided.
On $DFIR_LAB, note which format your practice image uses and one tool that opens it (Autopsy, FTK Imager literacy).
Command guide
Try these commands — Image formats (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST hashing — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds (integrity literacy) RFC 3227 — https://www.rfc-editor.org/rfc/rfc3227 (document hashes at acquisition) SANS DFIR — https://www.sans.org/cyber-security-skills/digital-forensics/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
python3 - <<'PY'
data = b'CYBERLIUM-LAB-DFIR-SAMPLE\x00\xde\xad\xbe\xef'
path = __import__('os').path.join(__import__('os').environ.get('LAB_DFIR', __import__('os').path.expanduser('~/cyberlium-lab/t26-dfir')), 'evidence', 'sample.bin')
open(path, 'wb').write(data)
print(f'Created {path} — YOUR lab binary sample only')
PYCommand — copy this
file "$LAB_DFIR/evidence/sample.bin"
Primary tools to practice this lesson: sha256sum, python3. Reference sites: NIST hashing (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds); RFC 3227 (https://www.rfc-editor.org/rfc/rfc3227); SANS DFIR (https://www.sans.org/cyber-security-skills/digital-forensics/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Physical vs logical (named)
Physical imaging: full device or partition sectors — includes unallocated and slack. Logical: selected files/folders — faster but misses deleted and unallocated artifacts.
Defenders choose based on scope and time; students document the choice on lab worksheets.
3. Imaging ethics boundary
Forbidden: imaging stranger USB, phones, or PCs without legal authority. Allowed: imaging checklist naming format, target, and authority source for $DFIR_LAB.
Ship: imaging card — format, physical/logical, target description, authority cite. Next: Hashing Integrity.
4. What you ship: imaging card for $DFIR_LAB
Format, physical/logical, target, authority. $DFIR_LAB named. NO stranger hardware. chmod 600.
5. What you record before the next lesson
Date. Imaging card. $DFIR_LAB named. File t26-m03-l01-imaging-named.txt chmod 600.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Image a found USB drive. Skip format notes because 'Autopsy opens anything.'
Right
Write imaging card for YOUR $DFIR_LAB practice target. Next: Hashing Integrity.
Mission: name YOUR practice image format
1) State image format (E01/raw/VM). 2) Physical vs logical one-liner. 3) Cite authority source. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
E01 metadata can carry case fields — fill them in real casework.
Knowledge Check
APPLY: Imaging literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Physical imaging includes unallocated space.
True or False
Knowledge Check
APPLY: Before imaging you must have:
Multiple choice