Understanding Disk Image & Recovery¶
Disk image examination and recovery turns an acquired storage image into a controlled working view from which relevant files, partitions, metadata, and deleted content can be assessed.
What you will learn
By the end, you should be able to explain safe image mounting, distinguish file system recovery from carving, and preserve the provenance of recovered files.
What is disk image examination?¶
Core concept
An examiner opens or mounts a verified image using a method suited to the investigation. File system tools use metadata to present known paths and records; carving tools search byte patterns and may recover content without its original name or path.
Keep in mind: Recovered content is derived evidence. Record the source image, offset or artefact, tool, settings, and integrity hash.
Recovery methods¶
Why it matters¶
Protect originals¶
Controlled image access keeps repeated analysis away from original media.
Recover deleted content¶
Metadata, snapshots, and carving may reveal files no longer visible to a user.
Retain context¶
File system aware methods can preserve paths, timestamps, and relationships.
Support repeatability¶
Recorded settings and output hashes allow recovery results to be checked.
How examination and recovery works¶
- VerifyConfirm the image hash, format, source notes, and working copy status.
- OrientIdentify partitions, file systems, encryption, time context, and relevant volumes.
- ExamineUse a read only or controlled view to locate allocated and deleted records.
- RecoverExport selected files or carve content to a separate controlled destination.
- DocumentHash recovered output and record source location, method, settings, and limitations.
Practice scenario¶
You are examining a workstation image after a project folder went missing. Check a working copy, look through deleted file records, and recover readable documents. Try carving to find files whose records are missing. Read the results, keep what helps the case, and give the next analyst your files and notes.
Find the missing project documents
A manager reports that the Aster project folder has disappeared from Alex’s workstation. Your team has permission to examine a disk image of it. Find out what can still be recovered, then leave the lead analyst your files and notes.
Browser practice · You are using a small training sample, not a real disk image. You can download the PDFs you recover and a record of your work. No real disk is read or changed.
- 1Check the copy
- 2Recover a file
- 3Try carving
- 4Hand over
Check your working copy
Check that the copy matches the image before you start looking for files.
Start with a copy you can trust
Your copy for this case · open without changing its contents
A hash is a fingerprint made from a file’s contents. Check that your copy’s fingerprint matches the one recorded when the image was made. Read only means you can look inside without writing changes to it.
See the hashes and training details
- Hash recorded when imaged · SHA-256
Preparing sample…- Working copy hash · SHA-256
Not checked yet- About this sample
- Hashes are calculated from a 16,384-byte browser sample. File records are examples; this exercise does not read a real NTFS file system. A match checks the copy’s contents, not who used the computer or whether every part of the original disk was captured.
Preparing your working copy…
Optional: try a damaged copy
Change one small piece of the copy, then check it again. Can you still trust the copy? Use a fresh copy to get back on track. This clears your recovered files and notes; the stored original stays unchanged.
Look inside the missing folder
This case represents a Windows disk using NTFS, a common way Windows organises files. It keeps records of file names, locations and times. Some records may remain after a file is deleted. Open them and check whether the document is still readable.
C:\Users\Alex\Documents\Aster\Working copy · read onlySee the file record and recorded times
Keep recovered files outside the image.
Open a deleted file record to inspect it.
Find files that lost their names
You recovered a file using its record. Now try carving: looking for a file’s contents when its record is missing. Search unallocated space, storage not currently assigned to a file. It may still hold deleted data. Read the results and keep anything that helps explain the missing folder.
Not scannedUnallocated space
Look for PDF contents
Search not started.
See where this result was found
Read each result before keeping it. Some may be unrelated or already recovered.
Why can’t carving bring back every file?
New data may have replaced the old data. A file may also be split across the disk, encrypted or incomplete. This exercise searches for PDF start and end markers in bytes 4,096 to 16,383 of the sample. Its readable PDFs are stored in one piece. Real recovery tools need more checks, and recovery is not guaranteed.
Give the next analyst your files and notes
One still has its original name and folder recorded. The other came from carving, so you know less about where it belonged. Its note about a USB gives the team something to check; it does not prove data theft.
We add the file details and hashes for you. Write what the documents show and what is still unknown. You can leave out unrelated files before saving.
Add a note, then save your files and recovery record.
You checked a copy, recovered a file by its record and found another through carving. Download your files and notes, then try the same workflow in Autopsy.
Try the Autopsy labKeep the recovery traceable¶
Prefer the method that retains context
- 1VerifyConfirm the image and working copy.
- 2LocateUse partitions and metadata before raw search.
- 3RecoverExport to a separate controlled location.
- 4TraceRecord source, method, hashes, and limitations.