<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: acquiring-disk-images
description: >-
  Forensic disk image acquisition using dd, dc3dd, ewfacquire, and FTK Imager.
  Covers raw (dd), Expert Witness (E01), and AFF4 formats with cryptographic
  hash verification, write-blocking, and chain of custody documentation for
  legally defensible evidence preservation.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - disk-imaging
  - dd
  - dc3dd
  - ewfacquire
  - ftk-imager
  - e01
  - write-blocking
  - chain-of-custody
  - evidence-preservation
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1005", "T1074"]
  nist-csf: ["RS.AN-1", "RS.AN-3"]
  frameworks: ["NIST SP 800-86", "RFC 3227", "ACPO Good Practice Guide"]
---

# Acquiring Disk Images

## Overview

Forensic disk imaging creates a bit-for-bit copy of storage media for
examination without modifying the original evidence. This skill covers
acquisition tool selection, write-blocking, format trade-offs (raw vs E01
vs AFF4), hash verification, and chain of custody procedures compliant
with NIST SP 800-86 and RFC 3227.

## Prerequisites

- Linux forensic workstation (SIFT, Tsurugi, or Kali)
- `dc3dd`, `ewfacquire` (libewf-tools), `guymager`, `fdisk`, `mmls`
- Hardware write blocker (Tableau T35u, WiebeTech) or software blocker (`blockdev --setro`)
- Sufficient storage: target disk size × 1.1 for raw, × 0.6 for compressed E01
- Root / sudo access for raw device reads

```bash
sudo apt install dc3dd libewf-tools sleuthkit guymager
```

## Key Concepts

### Image Formats

| Format | Extension | Compression | Hash Embedded | Metadata | Tool |
|--------|-----------|-------------|---------------|----------|------|
| Raw | `.dd`, `.raw` | None | No | None | dd, dc3dd |
| E01 | `.E01` | zlib | MD5/SHA1 | Case info | ewfacquire, FTK |
| AFF4 | `.aff4` | snappy/lz4 | SHA256 | Extensible RDF | aff4imager |
| VMDK | `.vmdk` | Optional | No | VM metadata | qemu-img |

### Write Blocking

**Hardware (preferred for court):**
```bash
# Verify write blocker is active — device should be read-only
hdparm -r /dev/sdb    # Returns: readonly = 1 (on)
```

**Software (Linux):**
```bash
sudo blockdev --setro /dev/sdb
# Verify
blockdev --getro /dev/sdb    # Returns: 1
```

### Hash Verification Strategy

```
Pre-image:  sha256sum /dev/sdb > pre_hash.txt
Acquisition: dc3dd ... hash=sha256 log=acq_hash.log
Post-verify: sha256sum evidence.dd > post_hash.txt
Compare:     diff pre_hash.txt post_hash.txt
```

## Workflow

### Step 1: Identify and Document Target Media

```bash
# List all attached storage devices
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT,SERIAL,MODEL
fdisk -l /dev/sdb

# Record device serial number for chain of custody
udevadm info --query=all --name=/dev/sdb | grep -E "SERIAL|MODEL|VENDOR"

# Verify partition layout with Sleuth Kit
mmls /dev/sdb
```

### Step 2: Enable Write Protection

```bash
# Software write-block
sudo blockdev --setro /dev/sdb
sudo blockdev --getro /dev/sdb  # Confirm returns 1

# Verify no writes occurred
cat /proc/diskstats | grep sdb  # Note write count — should stay at 0
```

### Step 3: Acquire Raw Image with dc3dd

```bash
# dc3dd — forensic variant of dd with built-in hashing and logging
sudo dc3dd if=/dev/sdb of=evidence.dd \
  hash=sha256 hash=md5 \
  log=acquisition.log \
  hlog=hash.log \
  rec=off \
  2>&1 | tee acquisition_console.log

# Split large images into 2GB segments
sudo dc3dd if=/dev/sdb ofsz=2G of=evidence.dd \
  hash=sha256 log=hash.log
```

### Step 4: Acquire E01 Image with ewfacquire

```bash
# E01 format — compressed with embedded hashes and case metadata
sudo ewfacquire /dev/sdb \
  -t evidence \
  -C "Case-2026-0317" \
  -D "Suspect Workstation HDD" \
  -e "Examiner Name" \
  -E "Agency / Organization" \
  -N "Evidence item description" \
  -c deflate \
  -S 2G \
  -u

# Verify E01 integrity
ewfverify evidence.E01
```

### Step 5: Verify Image Integrity

```bash
# Raw image verification
sha256sum evidence.dd
cat hash.log  # Compare dc3dd recorded hash

# E01 verification
ewfverify evidence.E01

# Mount and spot-check (read-only)
OFFSET=$(mmls evidence.dd | awk '/NTFS/{print $3; exit}')
sudo mount -o ro,loop,noexec,nosuid,offset=$((512 * OFFSET)) evidence.dd /mnt/evidence
ls /mnt/evidence/Windows/System32/config/
sudo umount /mnt/evidence
```

### Step 6: Chain of Custody Documentation

```
Evidence Tag: CASE-2026-0317-HD01
Date/Time Collected: 2026-03-17T18:54:00Z
Collected By: [Examiner Name, Badge/ID]
Location: [Physical location of seizure]
Device: [Make/Model/Serial]
Hash (SHA-256): [hash value]
Hash (MD5): [hash value]
Write Blocker: [Model/Serial]
Storage: [Where image is stored]
Transfer Log:
  - 2026-03-17T19:00:00Z: Transferred to forensic workstation
  - 2026-03-17T19:05:00Z: Verified hash match
```

## Detection

```yaml
title: Acquiring Disk Images Detection
id: f36e7be9-9915-4c15-98cb-737e9478bcfe
status: experimental
description: Detects suspicious activity related to acquiring disk images techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*acquiring*disk*"
  condition: selection
level: medium
tags:
  - attack.t1005
  - attack.t1074
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] Write blocker engaged before any device access
- [ ] Pre-acquisition hash recorded
- [ ] Image acquisition completed without errors
- [ ] Post-acquisition hash matches pre-acquisition hash
- [ ] Chain of custody form completed with all fields
- [ ] Image mounts read-only and contains expected file systems
- [ ] Acquisition log preserved alongside image file

## References

- [NIST SP 800-86 — Guide to Integrating Forensic Techniques](https://csrc.nist.gov/pubs/sp/800/86/final)
- [dc3dd — DoD Cyber Crime Center](https://sourceforge.net/projects/dc3dd/)
- [libewf — Expert Witness Format Library](https://github.com/libyal/libewf)
- [RFC 3227 — Guidelines for Evidence Collection](https://datatracker.ietf.org/doc/html/rfc3227)
- [Sleuth Kit — mmls, fls, icat](https://sleuthkit.org/)
