Overview of forensic imaging

Having a solid understanding of the facets of forensic imaging is important for incident response analysts. Having an understanding of the tools, techniques, and procedures ensures that evidence is handled properly and that the analyst has confidence in the evidence acquired. In addition, understanding the terminology allows the analysts to accurately prepare reports and testify as to their findings if the need arises.

One of the first concepts that should be understood is the difference between forensic imaging versus copying. Copying files from a suspect hard drive or other medium only provides analysts with the actual data associated with that file. Imaging, on the other hand, allows the analyst to capture the entire drive. This includes areas such as slack space, unallocated space, and possibly access deleted files. Imaging, also maintains the metadata on the volume to include the timestamps for files. This becomes critical in the event that a time line analysis...