How to Extract the disk image from the USB thumb drive

$ mount
you should see the USB thumb drive mounted
/dev/disk3s1 on /Volumes/JIANG-USB

Before you extract the USB disk image, you should unmount the disk. Otherwise, it give you device busy message.
$ sudo umount /dev/disk3s1
For mac:
$ sudo diskutil unmount /dev/disk3s1

Then you could use dd to extract the USB disk image:
$ dd if=/dev/disk3s1 of=~/USB_Image.raw

How to compare two disk RAW images

use tool Autopsy!
here is the couse website:
http://www.cs.gmu.edu/~astavrou/ISA785_F11.html
In week 2, CERT Forensic Tools is an wmare image which has Autopsy inside of the VM.
Analysis of disk images by using Autopsy

convert vmware VMDK disks to RAW format that is used as an input to the forensics programs (including Autopsy).

How to convert vmware VMDK diks to RAW format(used us an input tor forensics including Autopsy)

1) Install QEMU, a program that can covert vmware VMDK disks to RAW format that

is used as an input to the forensics programs (including Autopsy). 

The command for that is: 

$ yum install qemu (remember to enable networking on the CERT virtual machine if it is no on).

2) Execute $ qemu-img convert -O raw linux.vmdk raw-linux.bin 

(from the shared folders directory "linux.vmdk" is the infected VM Disk)