Logical imaging apparatus and method for digital forensic triage

A logical imaging apparatus for digital forensic triage, logical imaging apparatus including a processor and a memory operably coupled to the processor, wherein the memory stores program instructions to be executed by the processor, comprising:

• a user interface output device for displaying results of the digital forensic triage;
• wherein the processor is configured to perform:
• receiving files selected as a digital evidence target;
• creating a logical imaging file by logically imaging the selected files so as to generate digital evidence images from the selected files, inside of which is formatted in a predetermined file system structure, recording the selected files in accordance with the file system structure of the created logical imaging file, and storing selected file list information about a list of the recorded selected files;
• and
• creating a separate selected list information file and a separate logical imaging summary file outside the logical imaging file,
• creating a report file, in which completion of logical imaging is recorded, based on the logical imaging file, the selected list information file, and the logical imaging summary file;
• and
• outputting the logical imaging file to the user interface output device for analysis by a user,
• wherein storing the selected file list information comprises:
• creating a logical imaging file corresponding to a total size of the selected files;
• formatting the created logical imaging file by loading a predetermined system configuration into the created logical imaging file;
• storing the selected files in the formatted logical imaging file and information about the list of the stored selected files;
• and
• generating hash values for integrity verification of the logical imaging files, wherein the hash values comprise a first hash value for respective selected files and a second hash value for whole contents of the selected files,
• wherein:
• the logical imaging file, the selected list information file, the logical imaging summary file and the report file are provided to an investigator, and
• the selected list information file and the report file are provided to a suspect,
• integrity of the logical imaging file and the logical imaging summary file is verified using information recorded in the selected list information file, which include selected file list information identical to that recorded in the logical imaging file and the first hash values for respective selected files, and
• integrity of the logical imaging file, the selected list information file, and the logical imaging summary file is verified using information recorded in the report file, which include a third hash value for the logical imaging file, the second hash value for whole contents of the selected files, and a fourth hash value for the selected list information file,
• the predetermined file system structure is one among the formats including exFAT, FAT32, or NTFS,
• the extension of the created logical imaging file is .dd or .d01, and
• the selected list information, in which selected file information is recorded, is created and stored in the form of snapshot.txt in a formatted logical imaging file,
• wherein the report file is configured such that principal information of a target system, which includes system information, device information, and artifact information, and information about an evidence image and extraction list, which includes a logical imaging time, the third hash value for the logical imaging file, the second hash value for whole contents of the selected files, and the fourth hash value for the selected list information file, are recorded in the report file.