Disk Image
Disk Image
Datenträger-Abbild
A disk image is a complete, bit-precise copy of a data carrier in a file — the basis of any serious disk forensics. It contains not only the visible files but also deleted areas, slack space and file-system structures. Work is done on it so that the original remains untouched.
History & facts. The disk image is the result of forensic imaging: with write protection, the entire data carrier is captured sector by sector and secured against unnoticed alteration via a hash value. Common formats store, alongside the raw data, also metadata about the acquisition. Because the image contains everything — including what is invisible in normal operation — it is the prerequisite for examining deleted data (file carving), slack space and complete timelines.
Outlook & recommendation. Handling the image follows clear rules: never work on the original, form and record hashes before and after acquisition, document all steps. With very large stores and in the cloud, the classic full image reaches its limits, which is why targeted (logical) acquisitions gain importance. Unchanged: the image and its hash are the foundation on which the probative force of the entire investigation rests.