Disk imaging obsolete media

Written by Ella Lesatele and Jen Weintraub

Status: Incomplete

Set up directories and tracking spreadsheets for each collection on R: --BornDigital In house

Disk Image (for 3.5” floppy discs):

Open FTK Imager. Make sure the correct drive is plugged into the computer.
Look at disk and be sure it is locked (ie little black sliding tab on right side is clicked so you can see through the hole). This makes it unwriteable.
Insert media in the drive, label-side up, metal-side in.
In the File menu, select ‘Create Disk Image’.
When ‘Select Source’ pops up, select ‘Logical Drive’ and click on ‘Next’.
When ‘Select Drive’ pops up, choose ‘A:\[FAT] and click on ‘Finish’.
When ‘Create Image’ pops up, click on ‘Add’.
When ‘Select Image Type’ pops up, select ‘Raw’ and click on ‘Next’.
When ‘Evidence Item Information’ pops up, enter the Case Number (eg ‘Data-152_49’), Evidence Number (eg ‘49’) and Examiner (your name). Click on ‘Next’.
When ‘Select Image Destination’ pops up, use Browse to find the correct folder (eg ‘R:\Born-digitalDataInHouse\Data-152\Data-152_49’). Use the case number (eg ‘Data-152_49’) for the ‘Image Filename’ box. Click on ‘Finish’.
In the ‘Create Image’ box, click ‘Start’. Wait for the data to transfer (usually 1-3 minutes).
Click on ‘Close’ for the ‘Verify Results’ pop-ups.
Remove the media from the drive.
Note result in the spreadsheet.
Take photo of the disk itself and put in the folder.

Disk Image (for Zip discs):

Open FTK Imager. Make sure the correct drive is plugged into the computer.
Insert media in the Zip drive, label-side up.
In the File menu, select ‘Create Disk Image’.
When ‘Select Source’ pops up, select ‘Physical Drive’ and click on ‘Next’.
When ‘Select Drive’ pops up, choose ‘Iomega Zip’ and click on ‘Finish’.
When ‘Create Image’ pops up, click on ‘Add’.
When ‘Select Image Type’ pops up, select ‘Raw’ and click on ‘Next’.
When ‘Select Image Destination’ pops up, use Browse to find the correct folder (eg ‘R:\Born-digitalDataInHouse\Data-152\Data-152_49’). Use the case number (eg ‘Data-152_49’) for the ‘Image Filename’ box. Click on ‘Finish’.
In the ‘Create Image’ box, click ‘Start’. Wait for the data to transfer (usually 1-5 minutes).
Click on ‘Close’ for the ‘Verify Results’ pop-ups.
Remove the media from the drive. If it has a case, replace it in the case.
Note result in the spreadsheet.
Take photo of the disk itself and put in the folder.

Disk Image (for CDs):

When ‘Create Image’ pops up, click on ‘Add’.
When ‘Select Image Type’ pops up, select ‘Raw’ and click on ‘Next’.
When ‘Select Image Destination’ pops up, use Browse to find the correct folder (eg ‘R:\Born-digitalDataInHouse\Data-152\Data-152_49’). Use the case number (eg ‘Data-152_49’) for the ‘Image Filename’ box. Click on ‘Finish’.
In the ‘Create Image’ box, click ‘Start’. Wait for the data to transfer. (Can be up to 10 minutes).
Click on ‘Close’ for the ‘Verify Results’ pop-ups.
Remove the media from the drive. If it has a case or an envelope, replace it.
Note result in the spreadsheet.
Take photo of the disk itself and put in the folder.

Disk Image (for 5 ¼” Floppies)

PART 1:

Choose the disk type (will usually be Apple Pro Dos, or MSDOS, either 1200 or 360K)
In the Output Image Directory, specify a path to the C (public) drive. It will look like this: C:\Users\Public\Disk images
The Output Image Filename should be the item name (eg. “Data-003_123.img”) Make sure the .img is there before you start! This should automatically update to the next number in the sequence.
Make sure the drive is plugged in. Gently insert the disk label-side-up and label-side-out. When it is all the way in, push the lever down until it clicks.
Click on “Capture Image Disk File”. A box will pop up showing the progress. If it reads properly, click on “Yay!” to advance the filename number. If “Bummer.” pops up, make a note of the error message and click on it to advance the filename number.
Move the lever up to remove the disk. If it has an envelope, replace it.

PART 2:

Open FTK Imager. Under “File”, choose “Add Evidence Item”.
Select “Image File” for source.
For Source Path, use browse to find your item’s file (eg. “Data-003_123”) in the Public drive.
When it shows up in the Evidence Tree, go to “File” and select “Export File Hash List”.
Use the same filename, but with a .csv as the extension. This will generate an Excel file.
Update the spreadsheet

Disk Image (via Kryoflux) (NEEDS MORE WORK)

Plug the Kryoflux unit to the drive, then the computer.
Plug in the power cord. If the red light does not come on in the Kryoflux unit, unplug from the power source and check other connections first.
The Kryoflux interface is at C\kryo\dtc\kryoflux-ui.jar.
Name the disk without a file extension (ex. Data-078_101)
Under File - Settings - Output, make sure the image path is going to the right folder (C:\kryo\dtc\Data-078)
For format, choose Apple DOS 400K / 800K sector image from the drop down menu (if you know it is a mac disk)
Click start.
Update spreadsheet.

For Both 5 1/4 in disks and Kryoflux files you need to create "bags" for the files and transfer them to R, as you have to image them to the c drive.

Process: still to come.