Working Copy
Definition
A copy of an exhibit on which examination work is performed, created from a verified forensic image. The original or master copy is preserved untouched; the working copy may be processed, enhanced, or exported without altering the master.
Related terms
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...
- ACPO Principles
- Four principles for digital evidence handling published by the UK's Association of Chief Police Officers (now maintained by the Forensic Science Regulator):...
- Chain of Custody Log
- The continuous record documenting every person who accessed a digital exhibit, every transfer of possession, every examination action, and the hash values...
- Continuity Witness
- The person who can testify to each transfer of the exhibit, from collector to analyst to storage to court. Every transfer must...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Hash Value
- A fixed-length digital fingerprint produced by running a file through a cryptographic algorithm such as SHA-256 or MD5. Identical files produce identical...
- Hash Value (Digest)
- A fixed-length output produced by a cryptographic algorithm such as SHA-256 applied to a data set. Any change to the input data,...
- Proprietary DVR Format
- Video storage format used by commercial CCTV/DVR systems that is specific to the manufacturer, often unplayable without the vendor's own software. The...
- Versioning Convention
- A systematic file-naming or directory structure that identifies which version of a processed file is current, preserves earlier processing stages, and prevents...
Explained in these topics
- Chain of Custody for Digital MediaA verified copy of the forensic image used for examination. All analysis is performed on the working copy, not the original image, so that the original remains...
- Chain of Custody for Media EvidenceA copy of an exhibit on which examination work is performed, created from a verified forensic image. The original or master copy is preserved untouched; the wo...