- Remove hard drive from the Xbox 360 hard drive unit (see removal steps).
- Connect the hard drive to the write blocker.
- Open up the terminal in Ubuntu.
- Next you must identify where the hard drive is located, I located the hard drive under /dev directory as sdc.
- Next calculate the md5 of the hard disk:
- md5sum /dev/sdc > XboxDiskName.md5
- Next the drive is imaged, this was done by typing the following:
- sudo dd if=/dev/sdc of=/media/externalHDD/XboxImageName.dd
- To check is the image created is the same the hard disk the MD5 is calculated:
- md5sum XboxImageName.dd > XboxImageName.md5
- The md5's can be compared to see if they are identical.
A final year university project; Performing an Xbox 360 investigation & finding Xbox 360 specific artefacts.
Tuesday, 1 February 2011
Creating a disk image using a write blocker and 'dd'
I do not have FTK imager at home but I can borrow a write blocker to aid me in imaging the hard drive. I have an installation of Linux (Ubuntu 10.04) with 'dd' installed and a Tableau t3u write blocker. Acqusition steps:
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment