Share:
Glossary Forensics

Forensic image

A forensic image is an exact, bit-for-bit copy of a storage device or file system that investigators analyse instead of the original.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

The copy is made through a write blocker so the original cannot change, and a Hash of the original and the image are compared to prove they are identical. Analysts then work on the image, leaving the original untouched, which protects the Chain of custody. Common formats include raw dd files and E01.

Try these tools

Hash Generator

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from any text, computed locally with the Web Crypto API.

File Checksum Calculator

Calculate MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 checksums of one or many files and compare them with a published value.

See also

  • Glossary Chain of custody
    The chain of custody is the documented record of who handled a piece of evidence, when, where and why, from collection to presentation.
  • Glossary Hash
    A hash is the fixed-length fingerprint a hash function computes from any input; the same input always gives the same hash.
  • Glossary File carving
    File carving is recovering files from raw storage by searching for their start and end signatures.
Back to Glossary
AdSense Placeholder
Slot: footer_leaderboard