Meet WiebeTech's CD/DVD Imager
You've earned your warrant and entered the premises intent on capturing data as quickly and efficiently as possible, only to come face to face with a pile of CDs and DVDs - all of which need to be quickly backed up for later analysis. WiebeTech's CD/DVD Imager comes to your aid. It automatically images and archives CDs and DVDs to hard disk, takes a picture of each CD/DVD and stores it with the disk image.

Superior Chain of Evidence
With the CD/DVD Imager, investigations can be performed more quickly, with greater evidence reliability, and with less expense.

Automatic
Load up the robot and let it fly. It will automatically image and archive CDs and DVDs to hard disk. A camera is mounted to the top of the robot because a picture comes in very handy when trying to match up a disk image with physical evidence.

Smart
Images made by the robot work easily with forensic software (EnCase, ILook or Forensic Toolkit)*, and the robot correctly handles some of the stranger disk formats such as open session and multi-session disks.*


Forensic Goals

1. To, after the capture session, be able to read the disc with tools supporting disc images
2. To be able to prove that the data on the disc is not altered during copy.
3. To be able to prove that the image created isn't altered AFTER THE IMAGE IS CREATED. This is done by creating a hash value (discussed below) of the images taken.
4. To be able to match the disc image with the physical evidence. A picture is taken (and a has of this file is also generated).

WiebeTech's CD/DVD Imager makes use of a CD/DVD ROM (purposely not writable). This provides:

1. Increased accuracy in reading optical media. Optical Read-Only devices are generally known for this increased accuracy
2. Increased forensicity. The original media cannot be modified by the Optical Imager as the drive physically does not have the ability to alter the content by appending data or burning over already burned bits.

Linux LiveCD
WiebeTech's LiveCD is a cd based flavor of Linux that provides everything you need to start capturing discs quickly. With it, boot any PC into a capture mode, load up the imager and let it go. It saves to the same standard dd format and relies on cdrdao for more stubborn discs (such as multisession). The LiveCD is free and ships with the imager.

Windows Compatibility with CD/DVD Inspector
Optionally, investigators may use InfinaDyne's CD/DVD Inspector 3.0 with Robotic Loader Extension. Available as a bundle with the CD/DVD Imager, this professional software gives you everything you need to automatically archive discs to drives, and even works with the Imager's camera.


MD5/SHA-1
Through options at runtime, an analyst may select no hashing, MD5 hashing, or SHA-1 hashing. The software will automatically hash both the disc image created as well as the photograph of the disc. MD5 (a 128 bit value) is well established and trusted by many, and SHA-1 (160 bits) is becoming more trusted by the forensic community. Some departments may have rigid rules, thus both are selectable.

Note: it is good forensic practice to print a copy of the hash output file after a capture session to keep this (forensically marked) copy in a separate, safe location. In this way the analyst can later prove that there were no alterations to the images after the images were created. Remember: if someone gains access to both disc images and hash logs, they could alter both the image and the hash log accordingly - thus a paper copy further strengthens the forensic chain of evidence.

* We realized quickly that allowing the investigator to choose his/her own forensic imaging tools would be best. Listening to analysts, we hear a lot of support for DD. So, by default, the CD/DVD Imager attempts an image with DD and if that fails it tries cdrdao (which handles multi-session discs better, and allows for exact duplicates to be burned from the image & toc file). However, it is possible for someone with scripting knowledge to change which programs image discs in the input hopper - it is up to these programs to create images compatible with forensic tools. Many tools happen to already recognize DD.