WiebeTech LLC
CD/DVD Imager User Manual - 5 -
Forensic Optical Media Captures
Unlike hard drives, images created from optical discs may vary in minor ways each time the image is
taken—even when the same disc and same optical drive are used. This is caused by a variety of factors,
such as the presence of dust particles or scratches, and the use of error-catching algorithms that are less
robust that those used by hard disk controllers. Considering such factors, any forensic investigation
involving evidence on optical media should have the following goals.
Goal #1: To acquire disc image files that can be read and analyzed by forensic software tools
designed for that purpose. There are a number of such tools available (e.g. FTK, EnCase, etc). Note:
these tools are not included with CD/DVD Imager.
Goal #2: To be able to prove that the original data on the disc is not altered during copy. This can
be assured by the use of imaging software that is forensically trusted for this task. The open-source,
Linux-based imaging tools included with CD/DVD Imager are dd and cdrdao. Both of these are widely
trusted by the forensic community. However, you may also substitute your own Linux-based imaging tool
if you prefer. This may be necessary for some discs—no single imaging tool is likely to handle every disc
you encounter. Forensic investigators must often try several tools before successfully imaging unusual or
problematic discs. However dd and cdrdao will handle the vast majority of optical discs you are likely to
run across.
Goal #3: To be able to prove that the disc image file isn't altered after its initial creation. This is
done by creating a hash value of the image taken. By running another hash of the disc image after
forensically analyzing it, you can prove that the image was not altered during the investigation.
Goal #4: To be able to match the disc image with the physical evidence. CD/DVD Imager takes a
picture of each disc and stores it with the disc image. A hash value of the picture file is also generated so
an analyst can later prove that the picture has not been altered.
Hash Values (MD5, SHA-1)
When starting the imaging process, you will be able to choose the hash type used. You may select no
hashing, hashing with MD5 (selected by default), or hashing with SHA-1. The software will automatically
hash both the disc image created as well as the photograph of the disc. MD5 (A 128-bit hash value) is
well established and widely trusted, and SHA-1 (160-bit) is becoming more trusted by the forensic
community. Because the goal here is not encryption but verification that the disc image is not
subsequently altered (without detection), either hash type should be fine. Some forensic departments
may have specific rules regarding hash types; thus, both are selectable.
NOTE: It is good forensic practice to print a copy of the hash
output file after a capture session and keep this (forensically
marked) copy in a separate, safe location. In this way the analyst
can later prove that there were no alterations to the images after
the images were acquired. (If someone gains access to the hash
logs, they could alter both the file and the hash log. Thus, a p
copy further strengthens the forensic chain of evidence.) aper
