Information Technology Reference
In-Depth Information
Imaging a memory (SD) card
There are many tools available that can image a memory card. The following example uses
WinHex
to create a raw disk image of the SD card. The following is a step-by-step process
to image a memory card using the WinHex software.
•
Connecting the memory card
: Remove the SD card from the memory slot and
use a card reader to connect the memory card to the forensic workstation.
•
Write protect the card
: Open the disk using WinHex. Navigate to
Options
|
Edit
Mode
and select the
write-protected
mode, as shown in the following screenshot.
This is to make sure that the device is write protected and no data can be written on
it.
WinHex view of Edit Mode (left) and WinHex Read-only Mode enabled (right)
•
Calculating the hash value
: Calculate the hash value of the memory card to make
sure that no changes are made at any point during the investigation. Navigate to
Tools
|
Compute hash
and choose any hashing algorithm.
•
Creating the image of the disk
: Navigate to
File
|
Create Disk Image
, as shown
in the following screenshot. Select the
Raw
image option (
.dd
) to create an im-
age. This completes the imaging of the memory card.
