WHAT IT PROVIDES
Forensic imaging is the foundation of obtaining and verifying evidence on a digital device. Not only does this open the door for further forensic analysis but it also retains and protects evidence by making a bit by bit copy. For device's that are still being used this is extremely important. Every minute that the device is used is possibly a minute where evidence is being overwritten by newer data.
Forensic imaging is the process of copying a device bit by bit. This creates an exact image of all usable parts of the HDD. This process can be broken up into 3 main parts. First there is the device you are attempting to image. The 2nd part is hardware or software write-blocker which prevents changes from being made to the original device during imaging. Lastly there is the forensic image that has been created from the original device that can be used in court or for forensic analysis.
Once it is determined that a device or hard disk drive (HDD) may contain digital evidence it is important to take steps to preserve the evidence.
We are able to image almost any device with a hard drive thanks to our forensic lab. Imaging is also available on location with our mobile forensic kits.
A forensic image makes an exact bit by bit copy of the original device, including all deleted portions of the device. During this imaging process a write-blocker is used to ensure that no changes are made to the data.
Now that the forensic image has been created we can start a forensic analysis in order to bring back deleted evidence or the image can be compressed, stored, and preserved for a later date.