Skip to content

Understanding Disk Image & Recovery

Disk-image examination and recovery turns an acquired storage image into a controlled working view from which relevant files, partitions, metadata, and deleted content can be assessed.

What you will learn

By the end, you should be able to explain safe image mounting, distinguish file-system recovery from carving, and preserve the provenance of recovered files.

What is disk-image examination?

Core concept

An examiner opens or mounts a verified image using a method suited to the investigation. File-system tools use metadata to present known paths and records; carving tools search byte patterns and may recover content without its original name or path.

VolumesAllocated filesDeleted recordsUnallocated spaceRecovered output

Keep in mind: Recovered content is derived evidence. Record the source image, offset or artefact, tool, settings, and integrity hash.

01MountPresent an image or volume for controlled access02Unallocated spaceStorage not currently assigned to a live file03CarvingRecover content using structure or signatures rather than file-system paths

Recovery methods

File-system recoveryUses metadata and may retain names, paths, and timestamps
File carvingUses content patterns and may lose original context
Shadow copiesUse snapshots created by the operating system
Record carvingSearches for repeated structured records within data

Why it matters

Protect originals

Controlled image access keeps repeated analysis away from original media.

Recover deleted content

Metadata, snapshots, and carving may reveal files no longer visible to a user.

Retain context

File-system-aware methods can preserve paths, timestamps, and relationships.

Support repeatability

Recorded settings and output hashes allow recovery results to be checked.

How examination and recovery works

  1. VerifyConfirm the image hash, format, source notes, and working-copy status.
  2. OrientIdentify partitions, file systems, encryption, time context, and relevant volumes.
  3. ExamineUse a read-only or controlled view to locate allocated and deleted records.
  4. RecoverExport selected files or carve content to a separate controlled destination.
  5. DocumentHash recovered output and record source location, method, settings, and limitations.

Choose the next step

ScenarioYou need to recover a deleted document from an E01 image. What is the safest starting approach?

Prefer the method that retains context

  1. 1VerifyConfirm the image and working copy.
  2. 2LocateUse partitions and metadata before raw search.
  3. 3RecoverExport to a separate controlled location.
  4. 4TraceRecord source, method, hashes, and limitations.

Tools in SUSA

Image mounting

Arsenal Image Mounter

Present supported images to Windows for controlled examination.

Integrated examination

Autopsy

Analyse images and review multiple forensic artefact types.

File carving

PhotoRec GUI

Recover file content using signatures where metadata is unavailable.

Continue learning