Evidence Acquisition

Evidence acquisition is the process of creating an exact, verifiable copy of digital evidence while ensuring the original data remains unaltered. This is arguably the most critical phase of any forensic investigation — if evidence is improperly acquired, everything that follows may be challenged or excluded.

---

Forensic Imaging

A forensic image (also called a forensic copy or bit-stream image) is a sector-by-sector copy of a storage device, capturing every bit of data including:

• Active files and folders
• Deleted files (if not yet overwritten)
• Unallocated space
• Slack space (unused portions of allocated clusters)
• File system metadata
• Hidden partitions and Host Protected Areas (HPA)

Types of Forensic Images

Type	Description	Use Case
Physical image	Bit-for-bit copy of the entire device (all sectors)	Full forensic analysis; captures everything
Logical image	Copy of the file system (files and directories only)	When only specific files or partitions are in scope
Targeted collection	Copies only specific files or folders	eDiscovery, triage, or when full imaging is impractical

---

Write Blockers