WinVote Forensics 2018

Research Objective

We conduct a comparative forensic analysis of the data stored on the now decommissioned WinVote voting machines.


On this page, we collect images of the harddrives that are contained within the WinVote voting machines. Each Winvote contains two disks, a small disk which stores the operating system for the WinVote, and a large disk, which stores, among other things, the WinVote software.


If you have an AVS WinVote voting machine, we need your help. Please consider contributing your disk images to this project. You can help us by following theses steps.

1. Extraction of the harddrives from the WinVote voting machine

We outline of how to remove physically the harddrives from the voting machine.

2a. Create a disk image of the harddrive.

Once you have extracted the harddrive, create a disk image for the drives. To do this, you need to connect the harddrives to your computer. We recommend using a 2.5in USB enclosure. Because the drives are female, you will also need an adapter with a missing pin, such as the DeLOCK IDE/IDE - cable interface/gender adapters (IDE, IDE, Black, Green, Male/Male), from for example, Amazon.
Once everything is assembled, connect the enclosure to your computer (running MacOS or Linux) using a USB cable.
Then run the following command from the Terminal (or a shell) in sudo mode to create the image:
dd if=/dev/<device> of=<filename >.iso bs=1mb
To check that the image was correctly created, you can try to to mount it. Once everything is done, please send the image (or a link to the image) to We collect all images and share them on this webpage.

2b. Send us the physical harddrives.

Alternatively, you can also send us the harddrives by postal service to:
Carsten Schürmann
Department of Computer Science
IT University of Copenhagen
Rued Langgaards Vej 7
DK - 2300 Copenhagen S
+45 26393606
We will create the images, share them on this homepage, and return the original drives to you by post.


In advance, thank you for supporting this research project. It cannot happen without your help.

Image Library


We discovered a deleted Chinese song on 4 out of 8 machines. If you want to listen to it, click here.