Forensic acquisition
Also known as: Forensische Sicherung, evidence preservation, acquisition
Creating an unaltered, hash-verified copy of a storage medium, memory or data set before anything on it is analysed or remediated.
Acquisition is the moment a running system becomes evidence. It is done write-protected, in full or targeted, and documented with cryptographic hashes; all further work uses copies. In cloud and IoT environments a complete acquisition is often impossible because the provider controls the hardware – logs, exports and API pulls then have to take its place and be documented accordingly.
- Standards and frameworks