todo:rewritable_hard_disks_and_flash_media [dumping.guide]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Rewritable Hard Disks and Flash Media ======

===== Introduction =====
{{wst>factory_save}}

There is a risk when plugging USB devices or other writeable storage media into a conventional operating system that the OS will write to the device, meaning a clean dump of the original media cannot subsequently be made. To enable as clean as possible a dump to be preserved - even in the case of used devices it is good to avoid making any further changes. Note that the write-protect switches that some SD cards doesn't actually prevent writes - if it works, it just tells the reader to not write to the card - not all readers will comply with this.

This method uses a forensics-oriented Linux distribution which defaults to blocking all devices in read-only mode to ensure as secure as possible an environment (without using a hardware write blocker) for imaging of writeable storage media.

{{wst>carts_important_notes}}

===== Methods =====

  - Dumping via network (preferred, system-level read/write does not need to be turned on)

  - Dumping to additional device connected to PC (still likely safe but requires system-level read/write ability to be enabled and at least one additional device set to read/write permissions)

==== Method 1 ====
**Tools required**
  * External USB drive of at least 4GB OR a writeable DVD
  * [[user:caine|https://www.caine-live.net/]]
  * [[user:rufus|https://rufus.ie/en/]] (if making a bootable live USB)

Basically the process is the same as Method 2, but you *do not* enable the system-wide write access, instead you just connect your PC to the network and copy your dump to another device.
==== Method 2 ====

**Tools required**
  * External USB drive of at least 4GB OR a writeable DVD
  * [[user:caine|https://www.caine-live.net/]]
  * [[user:rufus|https://rufus.ie/en/]] (if making a bootable live USB)

**Process**

  * Do not connect the external storage media that you wish to dump until instructed to do so.
  * Download CAINE from the link above
  * Either burn the ISO to a DVD or create a bootable live USB using Rufus. Insert the burned disc or USB into your system and reboot into CAINE
  * Check that the system-level mount policy is set to read-only (disk icon in the taskbar should be green). If this is red, right click it and change to read-only.

{{:todo:flashmedia-step1.png?600|}}
  * Run UnBlock - this should show you a list of devices that are currently attached to the system.

{{:todo:flashmedia-step2.png?600|}}
  * At this stage, connect the media you wish to dump and hit refresh in UnBlock. This should show up in UnBlock now with a device-level policy of writable. 
{{:todo:flashmedia-step3.png?600|}}
  * Change this to read-only by ticking the checkbox next to it in the listing and then hit OK)
  * From the list of devices, find and make a note of the device name related to the media you wish to dump (for the rest of this guide we'll call this //sdX//)
{{:todo:flashmedia-step4.png?600|}}
  * Open "caine's Home" and, from the list of devices at the left, find either an internal or external hard-drive to which you want to save the image. The device labels should be the same as you can see in your normal OS (e.g. Windows, Storage, Elements etc.) (for the rest of this guide we'll call this //$HARDDRIVE//)

{{:todo:flashmedia-step5.png?600|}}
  * Go back to unblock and find this hard-drive in the list of devices - hopefully it should be obvious from the relative sizes, otherwise you can find device labels by using the command 'lsblk -o name,label' from the command line)
{{:todo:flashmedia-step6.png?600|}}
{{:todo:flashmedia-step6a.png?600|}}
  * Click the checkbox next to the hard-drive and hit OK - this should now show as writable in UnBlock

{{:todo:flashmedia-step7.png?600|}}
  * Change the system policy to allow mounting devices in writable mode by right clicking the green disk icon in the task bar and selecting "make writable"

{{:todo:flashmedia-step8.png?600|}}
  * Open "caine's Home" again and find your hard-drive at the left - click to mount this. It will mount at /media/caine/$HARDDRIVE.

{{:todo:flashmedia-step9.png?600|}}
{{:todo:flashmedia-step10.png?600|}}
  * Open the console and dump the USB using the following command 'sudo dd if=/dev/sdX of=/media/caine/$HARDDRIVE/backup.img bs=4M status=progress'
{{:todo:flashmedia-step11.png?600|}}
===== Gathering and Submitting Dump Info =====

See [[submission:general|Gathering and Submitting Dump Info (Basic)]]