Forensic Imaging
Definition
The process of creating a bit-for-bit copy of a digital storage device using specialist tools that do not alter the original. The copy is verified against the original by comparing cryptographic hash values, typically MD5 or SHA-256. Analysis is conducted on the copy, never the original.
- Output
- Bit-for-bit copy of a digital storage device
- Verification
- Cryptographic hash comparison, MD5 or SHA-256
- Rule
- Analysis is done on the copy, never the original
- Requirement
- Tools that do not alter the source during acquisition
Common questions
Why is hashing used to verify a forensic image instead of just comparing file sizes?+
A hash reflects the exact bit content of the device, so even a single altered bit produces a completely different hash value, giving a far more sensitive and reliable check that the copy matches the original than file size or file count alone.
What happens if the original device is analysed directly instead of a working copy?+
Even read operations can change metadata such as last-accessed timestamps on some systems, which risks altering the evidence and undermining its integrity, so standard practice keeps the original untouched after imaging and works only from verified copies.
Related terms
- Benford's Law Analysis
- A data analytics technique based on the observed distribution of leading digits in naturally occurring financial data. Significant deviations from the expected...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Predication
- The reasonable basis that justifies opening a fraud examination. The ACFE holds that no examination should begin without adequate predication, meaning a...
- Spoliation
- The destruction, alteration, or concealment of evidence relevant to a legal proceeding. Spoliation can result in adverse inference instructions to a jury,...
- Whistleblower Statement
- An allegation or tip from an individual with inside knowledge of suspected fraud. It often constitutes the predicate for a fraud examination...