Disk Image
A sector-level or logical forensic copy of storage media created so analysis can be performed without modifying the original evidence.
Digital-Forensics Context
A forensic disk image preserves storage at sector level or in a forensic container so analysis can proceed without modifying the original medium. Raw images and formats such as E01 package data and metadata differently, while acquisition should document write protection, unreadable sectors, hashes, tools, and acquisition conditions.
Evidence Boundary
Copying visible files is not equivalent to imaging the storage device. File copies normally omit unallocated regions, slack space, filesystem metadata, and other structures that can contain evidential information.
Related Digital-Forensics Concepts
- Chain of Custody
- Write Blocker
- Cryptographic Hash
- Unallocated Space