Forensic imaging
Definition
The process of creating a bit-for-bit copy of a digital storage device using specialist tools that do not alter the original. The copy is verified against the original by comparing cryptographic hash values, typically MD5 or SHA-256. Analysis is conducted on the copy, never the original.
Related terms
- Benford's Law analysis
- A data analytics technique based on the observed distribution of leading digits in naturally occurring financial data. Significant deviations from the expected...
- Chain of custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Predication
- The reasonable basis that justifies opening a fraud examination. The ACFE holds that no examination should begin without adequate predication, meaning a...
- Spoliation
- The destruction, alteration, or concealment of evidence relevant to a legal proceeding. Spoliation can result in adverse inference instructions to a jury,...
- Whistleblower statement
- An allegation or tip from an individual with inside knowledge of suspected fraud. It often constitutes the predicate for a fraud examination...
Explained in
- Evidence Gathering Methods in Fraud ExaminationsThe process of creating a bit-for-bit copy of a digital storage device using specialist tools that do not alter the original. The copy is verified against the...