A bitwise copy is a representation, as complete as possible, of the readable storage area of ​​a data carrier at a specific technical level. Unlike a normal file copy, it does not only copy visible files and folders. With traditional hard drives, the addressable storage is read block by block or sector by sector and transferred to a forensic image or to a suitable target medium.

In IT forensics, this method is particularly relevant when the investigation aims to include more than just the current file inventory. Depending on the storage medium and the backup method used, file system structures, unallocated memory areas, fragments of deleted files, and other technical artifacts can also be part of the backup.

The commonly used term "1:1 copy" needs to be put into technical terms. With modern SSDs, NVMe storage, and smartphones, a sector-by-sector backup doesn't automatically mean that every physical memory cell is read. Therefore, the crucial factor is which data source was actually captured and at what technical level.

What is a bitwise copy?

In digital forensics, a bitwise copy refers to a backup method where a data carrier is not copied based on its visible files. Instead, the addressable memory at the respective layer is systematically read.

With a traditional hard disk drive (HDD), this usually happens sector- or block-by-sector. The file system doesn't decide which files are copied. As a result, storage areas that are not visible to the user in the operating system can also be included in the backup.

This is precisely the key difference compared to a normal backup via Windows Explorer, macOS Finder or a conventional backup program.

Why is the method called "bitwise" when sectors are being read?

The term has become established in digital forensics, but is a technical simplification. Modern data storage media are not normally read by addressing each individual bit separately.

Communication takes place via addressable storage blocks or sectors. From a technical perspective, "sector-wise" or "block-wise backup" might therefore be more precise.

The term "bitwise copy" is primarily intended to express that not only a selection of visible files is copied, but that the storage space accessible at the chosen technical level is captured as completely as possible.

What distinguishes a bitwise copy from a normal file copy?

A normal file copy operates at the logical level of the file system. For example, if a folder containing business documents is copied to an external hard drive, then basically all the files that are present and accessible there are transferred.

Storage areas that are not currently assigned to any file are usually not taken into account. Likewise, much technical information that could be relevant for later reconstruction is lost.

In contrast, a sector-by-sector backup captures the addressable storage itself. This allows not only visible files but also file system structures, unallocated areas, deleted file remnants, and other technical information to be preserved.

Why is a normal file copy often insufficient for a forensic investigation?

For many forensic questions, not only the files that a user can currently see are relevant.

Let's assume a company suspects data theft . An employee is alleged to have transferred confidential files to an external storage device shortly before leaving the company and then deleted traces of them.

A standard copy of the existing documents would only back up the current file inventory. However, reconstructing the actual events may require additional data sources: file system metadata, information about connected USB devices, shortcut files, system logs, unallocated memory, and other user artifacts.

Sector-by-sectoral security creates a significantly broader basis for investigation.

What data can a bitwise copy contain?

The specific content depends on the storage medium, file system, and backup method. For example, on a fully scanned traditional storage medium, the backup can include partition tables, file system structures, active files, file metadata, system files, application data, unallocated space, slack space, fragments of deleted files, temporary data, and log and event data.

The fact that these areas are part of a backup does not automatically mean that relevant information can be extracted from them. The actual forensic analysis only begins after the data backup.

What is Unallocated Space?

Unallocated space refers to storage areas that the file system is not currently assigning to any active file.

When a file is deleted, this does not necessarily mean that its contents are physically removed at the same time in certain storage systems. Often, the file association is first removed, and the relevant space is released for later reuse.

As long as the original data still exists, it can potentially be forensically reconstructed. A standard file copy does not capture this storage. A complete sector-by-sector backup, however, can include it.

What is Slack Space?

File systems manage storage in specific units. If a file does not fully utilize the last storage block allocated to it, unused storage may remain within that area.

Depending on the file system and previous usage, data remnants may remain there. This area is often referred to as "slack space".

Its significance depends on the case. It should neither be categorically ignored nor automatically considered a fruitful source of evidence.

Can a bitwise copy contain deleted files?

Yes. It can contain storage areas that still contain data from a deleted file.

However, this is not the same as successful recovery. Whether a deleted file can be reconstructed depends, among other things, on whether its original storage areas still exist, have already been overwritten, fragmented, or altered by other processes.

Modern SSDs also incorporate additional factors such as TRIM and garbage collection.

Is a bitwise copy truly a complete 1:1 copy?

The term "1:1 copy" is understandable in general usage, but not always technically precise.

With a traditional hard disk drive (HDD), the logically addressable storage via the standard interface can be copied very comprehensively. However, this does not automatically mean that every conceivable internal area of ​​the drive is accessible.

This distinction is even more important with SSDs. The operating system doesn't directly see the actual arrangement of the data in the flash memory cells. A controller operates between the operating system and the flash memory, managing the physical storage organization.

Therefore, technically precise documentation should specify which storage area was captured via which interface and using which method.

Why is an SSD treated differently in forensic analysis than an HDD?

An HDD stores information magnetically on rotating disks. An SSD uses flash memory and a controller with its own memory management.

This controller handles, among other things, the mapping of logical to physical memory areas. This allows the operating system to see an abstracted memory structure. The physical position of information within the flash chips can change without this being visible to the operating system.

What does wear leveling mean?

Flash memory cells cannot be written to and erased an unlimited number of times. SSD controllers therefore distribute write operations across different physical areas to distribute wear more evenly.

This mechanism is called "wear leveling". As a result, a logical block address does not have to permanently correspond to the same physical memory cell.

For digital forensics, this is an important reason why the statement of an absolutely physical “1:1 copy” can be problematic with an SSD.

What is Garbage Collection?

SSDs continuously organize their flash memory. Unused memory areas can be internally merged, prepared, and erased so that they can be written to again later.

This process is called garbage collection. It can affect deleted data because memory contents may be removed internally even though no deliberate overwriting by the user has occurred at the operating system level.

What is TRIM?

TRIM allows an operating system to inform an SSD that certain logical data blocks are no longer needed.

The SSD can then use this information for its internal storage management.

For forensic purposes, this means that a deleted file can be significantly more difficult to recover on an SSD than on a traditional HDD. If the affected storage area has already been internally wiped, even a subsequent sector-by-sector backup cannot retrieve the previous data.

Why should an SSD be used as little as possible after an important data deletion?

Further use may generate new write operations. Additionally, internal memory processes may continue to run.

If important data is accidentally deleted and there is a serious interest in recovery or forensic investigation, as little work as possible should be done on the affected data carrier.

However, there is no guarantee that the data will be preserved.

Can an NVMe SSD be backed up bit-by-bit?

Yes. The logically addressable storage via the NVMe interface can be read block by block with suitable hardware and software.

However, the same applies here: The backup reflects the logical level provided by the controller. It is not automatically a direct image of all physical flash cells.

Additionally, the form factor, interface, and protocol must be correctly identified.

Why are M.2 and NVMe not the same?

M.2 initially refers to a form factor, or rather a design and connector. NVMe, on the other hand, refers to a protocol for communicating with non-volatile storage via PCI Express.

An M.2 drive is therefore not necessarily an NVMe drive. This distinction is important for selecting suitable adapters and write blockers.

Can a USB stick be copied bit by bit?

Yes. The memory provided by the USB controller can generally be read sector by sector.

USB flash drives also use flash memory. Internal controller mechanisms can therefore also influence which data is accessible at the logical level.

Can an SD or microSD card be backed up bit by bit?

Yes. Memory cards can generally be backed up in blocks.

This can be relevant, for example, for digital cameras, dashcams, navigation devices, smartphones or other embedded systems.

Before backing up, it should be ensured that the operating system does not perform unnecessary write operations on the original medium.

What is the purpose of a write blocker?

A write blocker is designed to prevent an investigation computer from transmitting write commands to an original data carrier.

This is relevant because operating systems can perform automatic access as soon as a drive is connected. Controlled write protection reduces the risk of unintentional changes.

Hardware or software write blocker?

Hardware write blockers are physically installed between the original data carrier and the forensic system. Depending on the device, they support different interfaces such as SATA, SAS, USB, or NVMe.

In contrast, software-based write protection mechanisms operate at the level of the investigation operating system.

Which option is suitable depends on the data carrier and the specific backup procedure.

Does every forensic backup require a write blocker?

No. A hardware write blocker can be very useful for removable traditional storage media. However, this method is not readily applicable to smartphones, soldered-on memory, virtual machines, or certain live backups.

The actual goal is to prevent avoidable changes and to document unavoidable changes in a comprehensible manner.

What happens when a hard drive is encrypted?

An encrypted hard drive can generally be copied sector by sector. However, the resulting image will initially contain the encrypted data.

For later analysis, suitable access data, keys, or other decryption methods are required. Therefore, it is important to know whether a system is currently unlocked before backing up data.

Why can immediately switching off a computer be problematic?

On a running encrypted system, the volume may already be decrypted and accessible. This state may be lost when the computer is shut down.

Additionally, volatile information is removed from the RAM when the device is switched off.

Therefore, forensically relevant systems should not be treated according to the blanket principle of "shutting them down immediately." The decision depends on the system's condition and the specific question being investigated.

What should be considered when using BitLocker?

If a BitLocker-protected computer is switched off, a sector-by-sector backup may be possible, but the content remains encrypted.

If the system is already started and the volume is unlocked, additional backup options may be available.

Therefore, before changing the system state, it should be checked which data source is needed for the subsequent investigation.

What should you consider when using FileVault with modern Macs?

In modern Macs, encryption, hardware, and storage architecture are closely intertwined. Especially with Apple Silicon systems, backup no longer follows the classic scenario of a removed SATA hard drive.

The appropriate method depends, among other things, on the Mac model, the operating state, the macOS version, and the available access options.

Can a smartphone be copied bit by bit?

Modern smartphones differ fundamentally from traditional hard drives. Hardware-based encryption, secure key management, and operating system-specific security mechanisms determine which data can be extracted at all.

Smartphone forensics therefore employs various extraction methods. The actual achievable data depth depends, among other things, on the manufacturer, model, operating system version, device condition, and security configuration.

The blanket statement that a modern smartphone has been "completely copied bit by bit" can therefore be technically misleading.

Logical extraction, file system extraction, and physical acquisition

For mobile devices, it is essential to specify exactly what type of extraction was performed.

A logical extraction typically delivers data that is accessible via defined operating system or backup interfaces.

File system extraction can provide significantly deeper access to files, databases, and system structures.

An acquisition described as physical can have a different scope depending on the device. Therefore, these terms must always be considered within the context of the specific tool and device.

What do BFU and AFU mean in relation to smartphones?

BFU stands for "Before First Unlock". In simple terms, it refers to the state of a device after a restart, before it has been successfully unlocked for the first time.

AFU stands for After First Unlock and describes the state after this first successful unlocking.

Certain cryptographic keys and data classes may be available to varying degrees depending on this state. An unnecessary restart can therefore alter the possibilities of a mobile forensic investigation.

Can the RAM also be backed up?

Yes. Under suitable conditions, the contents of RAM can be saved in a memory dump or RAM image.

However, this is not the same data source as a hard drive copy.

The main memory can contain running processes, active network connections, temporary data, and other volatile information.

Why can RAM be crucial in a cyberattack?

Certain malware programs operate primarily in RAM. Active processes and network connections can also be detected there.

If the computer is switched off, much of this information is lost.

In the event of a security incident, a decision must therefore be made as to whether volatile data should be secured first before a traditional data carrier acquisition takes place.

How is the integrity of a bitwise copy verified?

Cryptographic hash functions are used for integrity control. A checksum is calculated from a defined set of data.

If the same amount of data is processed again later using the same algorithm and the same hash value is produced, its unchanged state compared to the documented reference state can be verified.

For modern forensic workflows, SHA-256, for example, can be used.

What does a hash value prove?

A hash value is a proof of integrity. It can show that a defined set of data has not been altered compared to a known reference value.

He does not prove that the original data was factually correct. Nor does he identify the person who created or modified a file.

Integrity, authenticity, and authorship are different issues.

Why is it necessary to document what was hashed?

A hash value can only be meaningfully interpreted if it is known which data it refers to.

For example, the raw data stream of a RAW image can be hashed. A structured container format can additionally contain metadata, verification information, or compression.

The hash value of an entire container file therefore does not have to be identical to a hash value of the original raw data stream.

What happens in the case of reading errors?

A damaged storage medium may contain memory areas that can no longer be reliably read.

Professional imaging tools should detect and document such read errors.

Depending on the condition of the medium, problematic areas can be reread, initially skipped, or dealt with according to a defined strategy.

Is a bitwise copy with read errors unusable?

No. A data carrier can, for example, be almost completely readable and only have errors in a few areas.

The remaining data may still have significant forensic value.

It is crucial that the errors are documented and that the interpretation takes into account whether a relevant area is affected.

Why shouldn't a damaged hard drive be read indefinitely?

Repeated read attempts can worsen the condition of a hard drive if it is already mechanically damaged.

Unusual noises, severe speed drops, or frequent connection losses can be signs of a physical defect.

In such situations, specialized data recovery may be necessary. The priority is then to recover as much accessible data as possible.

Can a bitwise copy be analyzed multiple times?

Yes. That is precisely one of their key advantages.

If the relevant data carrier state is properly backed up, the same data set can be examined again later. Different analysis programs can also be used, provided they support the respective image format.

This allows an investigation to be reproduced or reviewed by a second expert.

Why shouldn't the original image be used as the working file?

In professional workflows, the original image can be archived unchanged, while the actual analysis is performed on a working copy.

This ensures that the initial security setting remains unchanged.

Should the working copy become damaged or a re-analysis be required, a new working basis can be created from the archived image.

Can a bitwise copy prove data theft?

Not alone. The security system initially provides the technical basis for the investigation.

To reconstruct a potential data breach, various artifacts must then be analyzed. These can include connected USB devices, file accesses, shortcut files, timestamps, user activity, or other system information.

Only a joint evaluation of these traces can enable a reliable statement.

Can a bitwise copy prove who copied a file?

Not automatically. For example, a computer can show that an activity took place under a specific user account.

However, this does not necessarily mean that only one specific natural person had access to this account.

Therefore, a technical assignment to a user account and the personal assignment to a specific person must be assessed separately.

Practical example: Suspected data theft by an employee

A company discovers that an employee processed unusually large amounts of data shortly before leaving the company. There is suspicion that confidential customer and project data was copied to a USB drive.

There are no obviously suspicious files left on the computer itself.

A standard copy of the user folder might not be sufficient for the investigation. Relevant information could include USB artifacts, shortcut files, file system information, user activity, and deleted data.

A sector-by-sector backup provides a broader data basis. This allows for subsequent investigation to determine whether multiple independent traces support the same sequence of events.

Practical example: Deleted photos on a hard drive

Photos were accidentally deleted from a traditional hard drive. After that, the computer was used very little.

A standard file copy would only capture the files that remain visible.

In contrast, a sector-by-sector backup can also include storage areas marked as free. If the original data is still present there, later reconstruction may be possible.

There is no guarantee, because previous overwrites can prevent restoration.

Practical example: Deleted files on an NVMe SSD

The same starting point can be assessed differently with a modern NVMe SSD.

TRIM and internal memory cleanup can cause deleted data to become unavailable at the logical level relatively quickly.

Here too, a timely backup is advisable. However, it cannot recover information that the SSD controller has already removed internally.

Practical example: A BitLocker-enabled notebook

A Windows notebook is switched on and the BitLocker-protected system is already unlocked. The device is to be forensically examined due to an internal incident.

If it is switched off without prior evaluation, the currently decoded state is lost.

A subsequent sector-by-sector backup of the data carrier may still be possible, but additional keys may be required for later analysis.

This example shows why the correct backup strategy should be determined before any change to the device's state.

When is a bitwise copy particularly useful?

Bitwise or sector-wise backup is particularly useful when deleted files need to be examined, a possible data theft needs to be reconstructed, manipulations are suspected, user activities need to be evaluated, or a defined data carrier state needs to be preserved for a later secondary examination.

It can also provide a suitable starting point in certain malware and cyber incidents, when examining external data carriers, or in cases involving technical issues relevant to evidence.

When is a bitwise copy not necessarily the best backup method?

A complete sector-by-sector backup is not necessary or technically possible for every issue.

In large server environments, targeted backups of relevant systems and data sources may be more practical. With cloud services, an investigator often lacks direct access to the underlying physical storage media.

For smartphones, the security architecture and extraction options determine which data can actually be backed up.

Even with an encrypted system in operation, a backup at the decrypted level can be more valuable for the specific question than just an image of the encrypted raw data carrier.

Typical errors in a bitwise backup

One of the most common mistakes is referring to a normal file copy as a bitwise copy. It is also problematic to describe a logical smartphone extraction as a complete physical copy or to use the term "1:1 copy" without technical context.

Other errors include confusing the source and target drives, unnecessary write accesses to the original, lack of documentation of read errors, insufficient integrity checks, and incorrect interpretation of hash values.

Furthermore, ignoring TRIM and internal controller mechanisms is problematic for SSDs. On encrypted systems, prematurely shutting down the drive can eliminate valuable access points.

FAQ on bitwise copying

What is a bitwise copy explained simply?

A bitwise copy is a backup that is as complete as possible of the accessible storage space of a data carrier at the technical level used. With traditional hard drives, this includes not only visible files but also other addressable storage areas.

Is a bitwise copy the same as a sector-wise copy?

The terms are often used synonymously. Technically, "sector-wise" or "block-wise" is usually more precise because data carriers are read via addressable memory blocks.

Is a bitwise copy a true 1:1 copy?

With a traditional HDD, the logically addressable storage can be mapped very comprehensively. For SSDs and other flash storage devices, the statement of a completely physical 1:1 copy should be avoided, because the controller mediates between the logical and physical storage structures.

What is the difference between a bitwise copy and a backup?

A backup primarily serves to restore files or systems. A bitwise forensic backup, on the other hand, is intended to preserve a defined storage state for later investigation. It can therefore capture areas that a normal backup does not include.

Can a bitwise copy contain deleted files?

Yes. If the relevant storage areas still exist and have not been overwritten or internally cleaned, data remnants can be part of the backup.

Are deleted files automatically restored by the backup?

No. The backup initially preserves the accessible data. Only during analysis is it checked whether deleted information can be identified and reconstructed.

Is deleted data on a hard drive always recoverable?

No. If the original storage areas have already been overwritten, the previous data cannot be recovered from them using a normal forensic analysis.

Is it possible to recover deleted data on an SSD?

This may be possible, but it strongly depends on the specific circumstances. TRIM, garbage collection, encryption, and internal flash management can render deleted data inaccessible.

How quickly should action be taken after an accidental deletion?

If the data is important, further use of the affected storage medium should be avoided if possible. There is no fixed timeframe within which data recovery is guaranteed.

Should I install data recovery software on the affected drive myself?

This can be problematic. The installation process generates new write operations and can overwrite storage areas that still contain relevant data. For important data, the source medium should ideally not be modified further.

Can an SSD be fully backed up bit by bit?

Logically addressable memory can, in principle, be backed up block by block. However, this does not mean that all internal physical flash states are read immediately.

Can an NVMe SSD be forensically secured?

Yes, provided suitable hardware and software are available and the drive is accessible. The specific characteristics of flash memory and controller management remain unchanged.

Can a USB stick be backed up bit by bit?

Yes. The memory accessible via its controller can, in principle, be scanned sector by sector.

Can an SD card be backed up bit by bit?

Yes. SD and microSD cards can also be read block by block.

Why is a write blocker used?

A write blocker is designed to prevent unintentional write access to an original data carrier. This reduces the risk of the computer performing the analysis altering the original data.

Is a write blocker necessary for every backup?

No. It depends on the device class and the acquisition method. It can be useful for a traditional, externally mounted storage device. Smartphones or certain live systems require different methods.

Can an encrypted hard drive be copied bit by bit?

Yes. However, the resulting backup may still be encrypted. Suitable keys or other access methods are then required for content analysis.

Should a switched-on computer be switched off immediately for forensic analysis?

Not necessarily. With an unlocked encrypted system or relevant volatile data, valuable investigative access could be lost. The right decision depends on the specific state of the system.

Can a smartphone be copied bit by bit?

Modern smartphones, due to their security and encryption architecture, cannot usually be treated like traditional hard drives. Mobile forensics employs various device-specific extraction methods.

What is a logical smartphone extraction?

A logical extraction captures data accessible via defined interfaces of the device or operating system. It does not automatically correspond to a complete sector-by-sector copy of the internal memory.

What is file system extraction?

File system extraction can provide more extensive access to files, databases, application data, and system structures. The exact scope depends on the device and the method used.

Why are hash values ​​used?

Hash values ​​are used for integrity control. They can be used to verify whether a defined set of data has changed compared to a documented reference state.

Is SHA-256 suitable for forensic analysis?

Yes. SHA-256 is a modern cryptographic hash function and can be used for integrity checking of forensic data sets.

Does a hash value prove that a file is genuine?

No. A hash value can verify that a file has not been altered compared to a reference state. It does not prove the truth of the content, nor does it automatically prove the origin of a file.

How large is a bitwise copy of a 1 TB hard drive?

In an uncompressed, full sector-by-sector backup, the storage requirement is roughly based on the addressable capacity of the source medium and not just on the size of the visible files. With suitable image formats, lossless compression can reduce the actual storage requirement.

Can a bitwise copy be compressed?

Yes. Forensic containers can store data in a lossless compressed format. The prerequisite is that the original information content is fully preserved during subsequent processing.

What happens if individual sectors cannot be read?

The read errors should be documented. The remaining data can still be fully analyzed. The assessment must consider whether relevant files or structures are affected by the erroneous areas.

Can the same bitwise copy be examined again later?

Yes. An unaltered and documented backup can be analyzed again later or with other forensic tools.

Can a bitwise copy prove that data was copied to a USB stick?

Not on its own. However, it can form the basis for examining various artifacts that might support or refute such a process. A connected USB drive alone does not prove a concrete file transfer.

Can a bitwise copy prove who deleted a file?

Not automatically. Digital traces can potentially be linked to a user account or specific activities. However, definitively linking them to a natural person requires further reliable evidence.

Is a bitwise copy automatically admissible in court?

No. The method of securing evidence is only one component of a forensic investigation. Factors relevant to the assessment include the origin of the evidence, documentation, integrity, chain of evidence, investigative methodology, and the specific legal situation.

What is more important: as much data as possible or the right backup method?

The appropriate data backup method for the question at hand. A larger dataset does not automatically provide a better basis for evidence. What is crucial is that the necessary data sources are backed up in a technically suitable, traceable, and, if possible, unaltered manner.

The crucial point regarding a bitwise copy

The forensic value of a bitwise copy does not arise from the designation "1:1 copy". What matters is what was actually saved.

With a traditional HDD, sector-by-sector backups can create a very comprehensive representation of the logically addressable storage medium. However, with SSDs, NVMe storage, and smartphones, controllers, flash management, encryption, and security architecture must be taken into account.

Therefore, professional documentation should clearly record the data source, backup method, tools used, any read errors that occurred, and integrity checks.

The bitwise copy does not yet answer the actual forensic question. It creates the most stable possible basis for investigation. Only the subsequent analysis determines which digital traces are present, how they can be technically classified, and what conclusions can actually be drawn from them.

Back to knowledge overview