ExamWizardzExamWizardz
Start free
Security

What is forensic imaging?

Forensic imaging is making a bit-for-bit copy of a storage device, deleted and unallocated data included, verified with hashes so it can serve as evidence.

What is forensic imaging?

Forensic imaging is the process of creating an exact, sector-by-sector copy of a storage device and proving with hashes that the copy matches the original. The result, called a forensic image, bit-level copy or bitstream image, holds everything on the media: active files, deleted files that haven't been overwritten, unallocated space, slack space, partition tables and file system metadata. Investigators analyze copies of the image and lock the original away, so the evidence itself is never put at risk.

It is not the same as the OS images IT teams use to deploy workstations. A deployment image is a template for building new machines; a forensic image is a preserved record of one specific device at one moment.

Physical, logical and live images

  • Physical image: every sector of the whole device. This is the standard for evidence because it captures deleted and hidden data.
  • Logical image: selected partitions, folders or files, collected through the file system. It is faster and smaller, and sometimes the only option for cloud accounts, phones or very large servers, but it misses anything the file system doesn't list.
  • Live image: taken from a running system. It is used when full-disk encryption would leave a powered-off drive unreadable, or when a server can't be shut down. The system keeps changing during the copy, so the image can't be compared with a fixed source hash; it is hashed when finished instead.

Image formats and tools

A raw image, often named .dd, .img or .raw, or split into numbered pieces such as .001 and .002, is a plain sector copy any forensic tool can read. Container formats such as E01, the Expert Witness Format, add compression, case details and an embedded hash of the acquired data, and AFF4 is an open alternative. Common tools include dd and its forensic variants dc3dd and dcfldd, FTK Imager, Guymager and ewfacquire. A dc3dd acquisition that hashes the data and logs the job while it copies looks like this:

dc3dd if=/dev/sdc of=/cases/2026-118/ws14.dd hash=sha256 log=/cases/2026-118/ws14-acq.log

The imaging workflow

  1. Document the device: photographs, make, model, serial number and condition.
  2. Connect the source through a write blocker.
  3. Hash the source with SHA-256.
  4. Image it to destination media that was wiped beforehand, so leftover data from an earlier case can't contaminate this one.
  5. Hash the image and compare the value with the source hash.
  6. Seal the original or a master image, make a working copy, verify the working copy's hash and analyze only that copy.

Matching hashes are what make the image defensible. If they differ, the cause has to be found and written down. A failing drive with unreadable sectors is a common one, because imaging tools typically substitute zeros for sectors they can't read, so the copy can no longer match.

Forensic imaging vs. backups and file copies

  • File copy: copies only the files the file system lists, gives the copies new timestamps and leaves deleted data behind.
  • Backup: built to restore data, not to prove what was on a device. Most backups skip free space and are never hashed against the source.
  • Snapshot: a point-in-time capture of a virtual machine or cloud volume taken by the hypervisor or cloud platform. It is the usual way to acquire virtual systems and is verified with hashes the same way.

Forensic imaging on the CompTIA Security+ exam

SY0-801 objective 4.8 names bit-level copies among the system images an investigation relies on, alongside memory dumps and snapshots, and objective 4.7 covers acquisition and preservation within incident response. Scenarios asking how to capture deleted files, or everything on a suspect drive, point to a bit-level image; scenarios asking how to prove the copy matches the original point to hashing. Watch the order: if the system is still running and the question involves fileless malware or encryption keys, a memory dump comes before the disk image. A plain file copy is the usual wrong answer.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

chain of custody

Chain of custody is the documented, unbroken record of who collected, handled, transferred and stored a piece of evidence, when, and why.

digital forensics

Digital forensics is the collection, preservation and analysis of digital evidence using documented methods so its findings hold up to legal scrutiny.

file hashing

File hashing is a cryptographic technique that generates a unique fixed-length string of characters (hash value or digest) from a file's contents, enabling verification of data integrity and authenticity without encryption. Any change to the file, no matter how small, produces a completely different hash, making it impossible to modify a file undetected.

order of volatility

The order of volatility is the sequence for collecting digital evidence from most to least volatile, so short-lived data such as RAM is captured first.

slack space

Slack space is the unused area between the end of a file and the end of its last allocated cluster, where fragments of older, deleted data can survive.

write blocker

A write blocker is a hardware device or software control that allows reading a storage device but blocks all writes, so evidence isn't altered.

← Back to the full CompTIA glossary