Disk Imaging

Disk imaging is the process of copying a drive or storage device in a structured way for forensic examination.

It matters when file history, deleted files, partitions, user activity, or operating-system artifacts may be relevant.

Power down or isolate the system when appropriate and avoid running tools that change disk contents.