Bit-Stream Image
Definition
Sector-by-sector exact copy of a storage medium, including unallocated and slack space. Created with dd, FTK Imager, EnCase or X-Ways. Output formats: raw.dd, EnCase.E01, AFF.
- Coverage
- Every sector, including unallocated and slack space
- Common tools
- dd, FTK Imager, EnCase, X-Ways
- Output formats
- raw .dd, EnCase .E01, AFF
- Field
- Digital forensics acquisition
Common questions
How does a bit-stream image differ from a normal file copy?+
A file copy only captures files the operating system currently lists as present. A bit-stream image copies every sector on the medium regardless of allocation status, which preserves deleted files, slack space, and file system metadata that a logical copy would miss entirely.
Why do formats like E01 matter alongside raw dd images?+
Formats such as E01 add embedded hashes, compression, and case metadata inside the image file itself, which supports integrity verification and chain-of-custody documentation in ways a bare raw .dd file does not provide on its own.
Related terms
- BSA 2023 Section 63 Certificate
- Mandatory certificate accompanying any electronic record produced as secondary evidence in Indian court. Replaces IEA Section 65B from 1 July 2024. Signed...
- Computer Forensics
- Application of investigative and analytical techniques to identify, preserve, acquire, examine and present digital evidence in a legally defensible manner. Five-stage pipeline:...
- Digital Evidence
- Any information of probative value stored or transmitted in binary form. Latent, volatile in part, easily altered, and admissible only if integrity...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- Volatile Evidence
- Data that exists only while a system is running: active processes, logged-in sessions, network socket state, decryption keys in memory, and command...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...