Forensic Image

A forensic image is a controlled copy of digital media created for analysis, often with hash verification so the copy can be compared to the original.

Forensic images are useful when a laptop, drive, or removable device needs to be examined without repeatedly working from the original source.

Do not create a casual file copy when a forensic image is needed; use a repeatable imaging process and document hash values.