Imaging
Forensic Imaging
Forensische Datenträgersicherung
Imaging denotes the creation of an exact, bit-precise copy of a data carrier for forensic investigation. Unlike a normal copy, it captures every sector — including deleted areas and slack space — and is secured against unnoticed alteration via a hash value. Work is then done on this copy, not on the original.
History & facts. The forensic image is the basis of a clean investigation: with write protection, a complete image is taken from the original and a hash is formed immediately; a second hash after the process proves that original and image are identical. All further steps are carried out on a working copy of the image, so that the original remains untouched and probative. Common formats store, alongside the raw data, also metadata about the acquisition.
Outlook & recommendation. With large stores and in the cloud, the classic full image reaches its limits, which is why targeted (logical) acquisitions gain importance. Unchanged, however, is the basic principle: never work on the original, always form and record hashes. Those who skip this step risk rendering the entire later analysis legally worthless.