Working Copy
Definition
A copy of an exhibit on which examination work is performed, created from a verified forensic image. The original or master copy is preserved untouched; the working copy may be processed, enhanced, or exported without altering the master.
- Field
- Digital forensics, chain of custody
- Source
- Made from a verified forensic image of the exhibit
- Purpose
- Examination, processing, enhancement, and export
- Master status
- Original or master copy is preserved untouched
- Integrity check
- Hash verified against the master before and during use
Common questions
Why is examination never performed directly on the master forensic image?+
Any analysis tool can alter metadata, timestamps, or file structure even unintentionally, so keeping the master untouched preserves a verifiable baseline that can be re-hashed at any point to prove nothing on the original changed.
How is a working copy verified against the master to maintain evidentiary integrity?+
The working copy's hash is generated at creation and compared to the master's hash, and this verification is documented so any later challenge to authenticity can be answered by showing the working copy was an exact, checked duplicate at the time examination began.
Can multiple working copies be made from one master exhibit?+
Yes, and this is common when several examiners or tools need independent access, since each working copy can be processed or even damaged without any risk to the master or to other examiners' copies.
Related terms
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...
- ACPO Principles
- Four principles for digital evidence handling published by the UK's Association of Chief Police Officers (now maintained by the Forensic Science Regulator):...
- Chain of Custody Log
- The continuous record documenting every person who accessed a digital exhibit, every transfer of possession, every examination action, and the hash values...
- Continuity Witness
- The person who can testify to each transfer of the exhibit, from collector to analyst to storage to court. Every transfer must...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Hash Value (Digest)
- A fixed-length output produced by a cryptographic algorithm such as SHA-256 applied to a data set. Any change to the input data,...
- Proprietary DVR Format
- Video storage format used by commercial CCTV/DVR systems that is specific to the manufacturer, often unplayable without the vendor's own software. The...
- Versioning Convention
- A systematic file-naming or directory structure that identifies which version of a processed file is current, preserves earlier processing stages, and prevents...
Explained in these topics
- Chain of Custody for Digital MediaA verified copy of the forensic image used for examination. All analysis is performed on the working copy, not the original image, so that the original remains...
- Chain of Custody for Media Evidence