Forensic Working Copy
Definition
A verified duplicate of the original file, created by hashing the original and confirming hash match, on which processing is performed. The original is never altered. Any enhancement is performed only on the working copy after authentication of the original is complete.
- Creation
- Verified duplicate confirmed by hash match to the original
- Rule
- Original is never altered
- Processing
- Enhancement performed only on the working copy
- Sequence
- Authentication of the original completes before enhancement begins
Common questions
Why must authentication happen before enhancement rather than at the same time?+
Authentication establishes that the original file is genuine and unaltered before any processing changes pixels, audio samples or other data, so doing enhancement first would make it impossible to separate what was originally present from what the enhancement introduced.
How is a working copy different from a forensic image of a whole device?+
A forensic image duplicates an entire storage device bit for bit, while a working copy is typically a single verified file, such as one video or photo, prepared specifically so an examiner can enhance or process it without risking the source evidence.
Related terms
- Authentication Forensics
- The examination of a media file to determine whether it is genuine: whether it was created by the claimed device, at the...
- Enhancement Forensics
- The processing of a media file to improve the perceptibility of its content, such as denoising, contrast adjustment, or frame interpolation. Enhancement...
- Provenance
- The documented origin of a media file: the device that captured it, the time and location of capture, the chain of custody...
- Scope Statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...
- Tamper Artefact
- A signal in a media file that indicates manipulation: a discontinuity in compression parameters, an inconsistency in noise profile, a gap in...