Disk Imaging and Triage Collection — Full Images vs. Targeted Artifacts

Full disk images are the gold standard. They’re also 500 GB files that take 4 hours to create and another 4 hours to copy. IR lives in the gap between forensic completeness and operational speed — triage collection is the discipline of capturing maximum investigative value in minimum time.

The Acquisition Decision Tree

Is litigation likely?
│
├── YES → Full disk image (E01 format, hardware write blocker)
│         + Memory acquisition
│         + Chain of custody documentation
│         Budget: 4–12 hours per system
│
└── NO → Is the disk >500 GB?
         │
         ├── YES → KAPE targeted triage (30 min) + Memory acquisition
         │         Full image only if specific need identified
         │
         └── NO → Full image if time permits; else KAPE triage
                  Document the decision rationale

KAPE Triage Collection — Standard IR Workflow

Setup

# Download KAPE to USB drive (or network share)
# Structure: KAPE\kape.exe, KAPE\Targets\, KAPE\Modules\

# Run from USB, output to network share
# Replace with case-specific paths
$KapePath = "E:\KAPE\kape.exe"
$TargetSource = "C:"
$TargetDest = "\\forensic-server\IR-2024-089\hostname_triage"
$ModuleDest = "\\forensic-server\IR-2024-089\hostname_processed"

Collection Command

# Standard IR triage — !BasicCollection covers most incident types
.\kape.exe `
  --tsource C: `
  --tdest $TargetDest `
  --target !BasicCollection `
  --vss `
  --zv false

# What !BasicCollection includes:
# $MFT, $LogFile, $J (USN Journal), $Boot
# Event Logs (Security, System, Application, Sysmon, PowerShell)
# Prefetch files (C:\Windows\Prefetch\*)
# NTUSER.DAT (all users)
# SAM, SYSTEM, SOFTWARE, SECURITY registry hives
# Scheduled tasks (C:\Windows\System32\Tasks\)
# SRUM database
# Browser history (Chrome, Firefox, Edge)
# LNK files and Jump Lists
# Shellbags (registry-based folder access history)
# Amcache.hve and Shimcache (application compatibility data)

Ransomware-Specific Collection

# For ransomware incidents: add shadow copy and backup enumeration
.\kape.exe `
  --tsource C: `
  --tdest $TargetDest `
  --target !BasicCollection,ShadowCopies,WindowsDefender `
  --vss `
  --zv false

# Also collect VSS listing separately
vssadmin list shadows > \\forensic-server\case\hostname_vss.txt

Full Disk Imaging with FTK Imager

For cases requiring full disk acquisition:

Physical prerequisites:
  1. Remove disk from suspect system OR use write blocker for attached disk
  2. Connect disk to forensic workstation via hardware write blocker
     (Tableau T35u or Wiebetech Forensic UltraDock recommended)
  3. Verify write blocker is engaged BEFORE connecting disk

FTK Imager steps:
  1. File → Create Disk Image
  2. Source: Physical Drive (select suspect disk)
  3. Image Type: E01 (Expert Witness Format)
  4. Evidence item information: case number, analyst, description
  5. Destination: forensic image server or large external drive
  6. Fragment size: 0 (single file, preferred unless limited storage)
  7. Compression: 6 (standard)
  8. ✓ Verify images after they are created
  9. ✓ Create directory listings of all files in the image
  10. Start — FTK computes MD5 and SHA1 during imaging

Post-imaging verification:

FTK Imager outputs a .txt verification file:
  Case: IR-2024-089
  Source: Physical Drive (WDC WD10EZEX)
  Sector Count: 1,953,525,168
  MD5 checksum: 9b4c2f1d...
  SHA1 checksum: 7e3a9f2c...
  Acquisition completed without errors
  Image verified successfully

Artifact Value Reference — What Each File Tells You