Data imaging and hashing

Imaging refers to the exact copying of data either as a file, folder, partition, or entire storage media or drive. When doing a regular copy of files and folders, not all files may be copied based on their attributes being set to the system or even hidden. To prevent files from being left out, we perform a special type of copy where every bit is copied or imaged exactly as it is on the current medium, as if taking a picture or snapshot of the data.

Creating a copy of each bit of data exactly as is, is referred to as a Physical Image. Performing a Bitstream copy ensures the integrity of the copy. To further prove this, a hash of the original evidence and the physical image are calculated and compared. If the copy is off by even one bit of data, the hash values will be quite different.

The original evidence should only be handled by qualified and authorized professionals and should also only be used to create forensically sound physical images. The original evidence should otherwise never be used as this compromises integrity and the investigation.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset