Disk & Storage Forensics
Every file system leaves a trail even after deletion — in slack space, journals, and metadata structures most users never know exist. Disk forensics is the discipline of reading that trail without disturbing it.
What is disk forensics?
Disk forensics is the acquisition and examination of data stored on hard drives, SSDs, and removable media — from live, user-visible files down to deleted content recoverable from unallocated and slack space. It rests on one non-negotiable principle: the original evidence is never analyzed directly, only a cryptographically verified copy.
Modern disk forensics spans forensic imaging, file-system-specific artifact analysis (NTFS, FAT32, ext4, APFS/HFS+), file carving for content with no surviving metadata, and timeline reconstruction that fuses hundreds of artifact types into one coherent sequence of events.
Acquire
Write-blocked, bit-for-bit imaging with hash verification at every step.
Recover
File carving and journal analysis surface deleted and hidden content.
Reconstruct
Super-timelines fuse MACB times, logs, and registry into one narrative.
Step-by-Step Methodology
The sequence a careful examiner follows, in order.
- 1
Attach a write blocker
Connect the source drive through a hardware (preferred) or validated software write blocker before any interaction — this is non-negotiable regardless of case size.
- 2
Create and verify the forensic image
Image with FTK Imager, Guymager, or dcfldd into RAW or E01 format, computing SHA-256 (and often MD5/SHA-1 for legacy compatibility) both before and after imaging to confirm bit-for-bit integrity.
- 3
Mount and triage the file system
Load the verified image (never the original) into Autopsy or an equivalent platform, and run ingest modules for hash lookup, file typing, and recent-activity parsing.
- 4
Analyze file-system-native artifacts
Parse $MFT, $LogFile, and $UsnJrnl (NTFS) or equivalent structures on other file systems to surface file creation, deletion, and rename events the visible file listing no longer shows.
- Registry hives for USB history, installed software, and user activity
- Prefetch, Jump Lists, and LNK files for execution and access history
- Shellbags for folder-browsing history, including deleted folders
- 5
Carve unallocated space
Run Foremost, Scalpel, or PhotoRec against unallocated space using known file signatures to recover files whose metadata has been fully reclaimed.
- 6
Build a super-timeline
Run log2timeline/Plaso across the image to merge file-system, registry, log, and browser artifacts into a single sortable timeline for correlation.
- 7
Check for anti-forensic activity
Compare $STANDARD_INFORMATION vs. $FILE_NAME timestamps for timestomping, inspect for wiping-tool artifacts, and note any encrypted or steganographically suspicious files for further review.
Tools Comparison
Sortable — click any column header.
Commands & Code
Copy-ready snippets used in real workflows.
# Image a write-blocked source device with dcfldd, hashing on the fly
dcfldd if=/dev/sdb of=case001_disk.img hash=sha256 hashlog=case001_disk.sha256
# Independently verify after imaging completes
sha256sum case001_disk.img
diff <(sha256sum case001_disk.img | awk '{print $1}') <(cat case001_disk.sha256 | awk '{print $2}')# Extract unallocated space from an E01 image for targeted carving
blkls -A case001_disk.e01 > unallocated.raw
# Carve known file types from the unallocated blob
photorec /d ./recovered /cmd unallocated.raw fileopt,jpg,enable,pdf,enable,zip,enable# Generate a Plaso storage file from a forensic image
log2timeline.py case001.plaso case001_disk.e01
# Export a filtered, human-readable timeline (CSV) restricted to a date range
psort.py -o dynamic -w case001_timeline.csv case001.plaso \
"date > '2025-01-01 00:00:00' AND date < '2025-02-01 00:00:00'"Legal & Ethical Considerations
- Only ever analyze a verified forensic copy — never the original media — to preserve both integrity and admissibility.
- Ensure the underlying seizure or imaging was performed under valid legal authority (warrant, consent, or statutory basis) before analysis begins.
- Document write-blocker model and hash values in your notes; a broken or unverifiable chain of custody is one of the most common grounds for evidentiary challenge.
- If encountering encrypted volumes, pursue only lawful key-recovery avenues (escrowed keys, legal process) — do not attempt unauthorized decryption workarounds.
Common Mistakes
- Booting or previewing the original drive on a live system without a write blocker, even 'just to check' — this alters access timestamps and journal state.
- Assuming file carving will recover fragmented files intact; most carving tools assume contiguous data and will produce corrupted output otherwise.
- Relying solely on $STANDARD_INFORMATION timestamps without cross-checking $FILE_NAME attributes, missing clear timestomping evidence.
- Treating a single artifact (e.g., one Prefetch entry) as conclusive rather than corroborating findings across multiple independent artifact types.