Lab Assignment $2$: Creating a Disk Image File of a Hard Disk Partition Lab Scenario

An investigator was performing forensics on a hard disk copy when he triggered a pre$-$loaded

process that deleted the entire disk data leading to loss of evidence. However, he had already created a forensic copy of the disk and this gave him the option to work on the same data again. Therefore, investigators should always create duplicates of the hard disk and perform the forensics process on the copy. To be a computer forensics expert, you must have sound knowledge of the various disk imaging tools used for forensics investigation.

Objectives

A disk image is a bit$-$by$-$bit copy of a hard disk or a disk partition, which includes all the files$/$folders$,$ deleted files, files left in the slack space and unallocated space, file system information, etc.

The objective of this task is to help students understand how to create a disk image file of a hard disk partition using R$-$Drive Image.