Forensic image
Also known as: Forensisches Image, disk image, bit-for-bit copy, forensic imaging
A sector-exact copy of a storage medium including deleted and unallocated areas, forming the basis for all further analysis.
Unlike a backup, a forensic image also contains what the operating system no longer shows: deleted files, file-system metadata, remnants of earlier use. It is sealed with a hash value and never altered; analysis runs on working copies. In virtualised systems the snapshot takes its place; from cloud services a full image is usually unobtainable.