When we are dealing with different computer forensic cases, we usually need to perform disk imaging. Disk imaging in computer forensics is different and much stricter than the common data copy and disk image, it must ensure the copied data is exactly the same with available simutaneous verification reports such as Hash or MD5 verification codes.
Computer forensic disk imaging is sector by sector image imaging all the contents of original disk including the location of the data, the file system, the lost or corrupted data, the hidden data, etc. Computer forensic disk imaging is one physical sector copy of the original disk and then is compressed to a file to be able to stored in other storage media for archiving and management or later restoration. So it is one forensically sound copy which retains the original data and is trusted in the court.
We can see in the market many disk imaging tools but one good computer forensic imaging tool will have write blocking solutions to protect the original data, it copies all the original data from the original disk to a good disk even if the original disk has some bad sectors or other kind of failures. In computer forensics, priority and emphasis are on accuracy and evidential integrity and security. For a qualified forensic examiner, he will always choose to have a forensically sound copy and then do the analysis on the copy while working directly on the original disk.
Data recovery Salon welcomes your comments and share with us your ideas, suggestions and experience. Data recovery salon is dedicated in sharing the most useful data recovery information with our users and only if you are good at data recovery or related knowledge, please kindly drop us an email and we will publish your article here. We need to make data recovery Salon to be the most professional and free data recovery E-book online.