Digital forensic process: Difference between revisions

Revision as of 19:21, 28 April 2017

Revision as of 00:18, 24 July 2017

Line 54:

==Acquisition==

[[File:Tableau TD3 Forensic Imager 2014-06-26 07-05.jpg|thumb|Example of a portable disk imaging device]]

[[File:Wikipedia and Libraries - The Connection.pdf|thumb|Automatic]]

Once exhibits have been seized an exact [[Disk sector|sector]] level duplicate (or "forensic duplicate") of the media is created, usually via a [[Forensic disk controller|write blocking]] device, a process referred to as ''[[Disk imaging#Hard drive imaging|Imaging]]'' or ''Acquisition''.<ref name="horenbeeck"/> The duplicate is created using a hard-drive duplicator or software imaging tools such as [[DCFLdd]], [[IXimager]], [[Guymager]], TrueBack, [[EnCase]], [[Forensic Toolkit|FTK]] Imager or FDAS. The original drive is then returned to secure storage to prevent tampering.