Dead Box Forensics: Write-Blocked Disk Imaging and Analysis

I produced a forensically sound image of a powered-off disk using a write blocker and dd, then carved and analyzed artifacts with The Sleuth Kit and Autopsy. The process recovered deleted files and confirmed evidence integrity with matching pre- and post-acquisition hashes.

Objective & Context

Dead box forensics analyzes non-volatile storage from a system that is off, preserving the disk exactly. This lab follows NIST SP 800-86 acquisition principles: write-block, image, hash, then analyze only the copy.

• T1070 Indicator Removal – recovering deleted logs and files an attacker tried to erase.
• T1505.003 Web Shell – locating planted web shells in the filesystem image.

Environment & Prerequisites

• Hardware or software write blocker on the source disk.
• The Sleuth Kit 4.12 and Autopsy; sufficient evidence storage (2x source size).
• A chain-of-custody log and hashing utility.

Step-by-Step Execution

1. Acquire a bit-for-bit image [ROOT REQUIRED]

2. Verify acquisition integrity

a1b2...  /dev/sdb
a1b2...  /evidence/case.img   # match = sound acquisition

3. Carve deleted files with The Sleuth Kit

Validation & Testing

Confirm the source and image hashes match before any analysis and document them in the custody log. Pass criteria: hash equality, at least one recovered deleted artifact, and analysis performed exclusively on the image copy.

Key Results

• Acquired a bit-for-bit image with 100% pre/post hash integrity.
• Recovered deleted artifacts from unallocated space via Sleuth Kit carving.
• Performed 100% of analysis on the working copy, never the original.
• Documented a complete chain of custody across the acquisition.