Disk imaging
Capture storage consistently and verify the copy before analysis.
The idea
A disk image is a representation of storage collected for analysis. A physical image may include areas beyond active files, while a logical acquisition focuses on selected filesystem content. The method, format, errors, and accessible regions influence what conclusions are possible. Use appropriate write protection and document hash values and acquisition details. Analyze a working copy when feasible, preserving the original and a controlled reference image.
In practice
An investigator images an authorized training disk, records its identifier and acquisition tool, verifies the digest, and opens a copy in a forensic analysis tool.
A common misunderstanding
A normal file copy is not always equivalent to a disk image; it can omit deleted content, metadata, or inaccessible areas.
Check your understanding
Why document read errors?
Think it through: They identify portions of the source that may be missing or unreliable in the acquired evidence.
Define what the image includes
A storage acquisition can target a physical device, a volume, or selected logical content. These scopes preserve different information. A file-level collection may answer a narrow question but omit unallocated space or filesystem structures available through another acquisition method. Choose the scope based on authorization, investigative need, technical constraints, and the device's condition.
Record source identity, acquisition method, tool version, destination, errors, and verification values. Cryptographic hashes can help demonstrate that a recorded image has not changed since hashing, but they do not prove that the original source was complete, truthful, or lawfully obtained. Integrity verification and acquisition validity are related but separate questions.
A fictional failing drive
An academy's old workstation drive produces read errors during acquisition. The examiner records the failures and follows the approved method for handling unstable media rather than repeatedly stressing it without a plan. The resulting image may contain unreadable regions, and later analysis must account for those gaps.
The report should distinguish a complete successful acquisition from a best-available image with limitations. Preserve the acquisition log and analyze a working copy where feasible. If encryption prevents access to content, obtaining a physical image does not automatically solve the key or live-state problem. The collection strategy may require specialist input.
Explain two scopes
For a fictional incident involving one application folder, compare a logical collection with a full-device image. State what each preserves, what it may omit, and why one might be proportionate. Include storage, privacy, time, and evidence needs. The exercise develops acquisition judgment rather than assuming the largest image is always the best or most appropriate choice.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: Integrating Forensic Techniques into Incident Response