/
Create image of 2.5 inch SATA hard drive

Create image of 2.5 inch SATA hard drive

Introduction


  • Use forensic workstation and FTK Imager to image 2.5 inch SATA hard drives.

Connect TC4-8-R2 cable to hard drive


  1. Retrieve TC4-8-R2 cable (unified SATA/SAS signal and power connector) from adapter box # 1 in digital forensics lab supply area​.


  2. Retrieve hard drive from Born Digital storage box (BD Box).

  3. Connect SATA connector to hard drive SATA pins​.

Mount hard drive in Tableau T35689iu forensic bridge


  1. Insert hard drive into​ drive dock with pins outward​.

  2. Connect 3M power connector to Tableau T35689iu forensic bridge​.

  3. Connect SAS signal cable to SATA port in Tableau T35689iu forensic bridge​.

  4.  Press the “Power” button on the Tableau T35689iu write-blocker​.

  5. Ensure Pwr, Dev, Host, and WrtBlk lights are green​. Note: if the drive is successfully mounted, it should also pop up in a File Explorer window where you can navigate the write-blocked drive​ 

Identify disk number and volume letter for physical drive


  1. Click on Windows start menu.

  2. Right click on "Computer" and click on "Manage" to open the Computer Management window.

  3. Navigate to Disk Management menu​.

  4. Identify disk number and volume letter for desired physical source​.

Launch FTK Imager and initiate "Create Disk Image..." process


  1. Double-click FTK Imager desktop icon or taskbar icon to launch program​.

  2. Click on the “File”​ menu and click on the “Create Disk Image…” to open Select Source window​.

  3. Select “Physical Drive” radio button Click “Next” button to open Select Drive window


Verify successful creation of disk image


  1. Check Disk Image MD5 window​. 

  2. Close window​. 

  3. Open Windows Explorer and confirm the following organization of data:

    1. D:\DATA
      1. Fonds/Collection
        1. Accession folder
          1. Evidence
            1. EvidenceID
          2. Evidence – copies
            1. EvidenceID_copy


Related content

Create image of optical media
Create image of optical media
More like this
Install FC5025 "Disk Image and Browse" software in Windows 10
Install FC5025 "Disk Image and Browse" software in Windows 10
More like this
Create image of 5.25 inch floppy disk
Create image of 5.25 inch floppy disk
More like this
Digital forensics workflow - 5.25 inch floppy disks
Digital forensics workflow - 5.25 inch floppy disks
More like this
Step four - create case in Forensic Toolkit (FTK)
Step four - create case in Forensic Toolkit (FTK)
More like this
Step three - Acquire data from digital storage devices
Step three - Acquire data from digital storage devices
More like this