A forensic image is a technically controlled copy of a digital storage medium or data set, serving as the basis for subsequent investigation. The goal is to secure the relevant data set as completely and transparently as possible, without having to reuse the original for every further analysis.

With traditional hard drives, a forensic image can capture the addressable storage sector by sector. This captures not only visible files and folders, but, depending on the storage medium, also file system structures, unallocated storage areas, and potentially remaining fragments of deleted data. This is precisely the key difference compared to a normal file copy.

However, the term should not be used too generally. Different technical requirements apply to SSDs, modern smartphones, encrypted systems, and cloud services. Therefore, a forensic image is not automatically a complete physical copy of every single storage state, but always the result of a specifically defined acquisition method.

What does "forensic image" mean?

A forensic image is a digital representation of a dataset that can subsequently be examined independently of the original. It documents the data carrier or system from which the data originated, the method used to capture it, and how its integrity can be verified.

For later analysis, it is crucial not only to consider the visible file content. Depending on the backup method, information may also be preserved that the operating system does not directly display to the normal user.

This can include file system tables, deleted file references, unallocated memory areas, metadata, and other technical structures. Especially when reconstructing past user activity, such information can be more important than the currently visible files.

What is the difference between a forensic image and a normal copy?

A standard file copy operates at the file level. For example, the user selects a folder and copies its contents to another storage device. Only the files that the operating system provides via the file system are transferred.

In contrast, a forensic image can be created at a deeper level. With a sector-by-sector backup, the system doesn't check which files are currently visible. Instead, it reads the addressable storage area of ​​the disk block by block.

• A normal copy primarily captures visible files.
• A forensic image can also contain file system structures.
• Unallocated memory areas can be retained.
• Deleted file remnants may still be present under certain conditions.
• The backup process is documented.
• Integrity can be verified using cryptographic hash values.

The difference is particularly relevant when not only current documents are needed, but also when a previous technical state needs to be reconstructed.

Is a forensic image the same as a forensic picture?

In practice, the terms "forensic image" and "forensic picture" are often used synonymously. Both describe a backup created for later forensic examination.

Technically, an image can be stored in different formats. Some formats contain only the read data blocks, while others additionally store information about the case, the source, hash values, or the segmentation of the backup.

Therefore, the decisive factor for the significance of the information is not so much the name itself, but the concrete question of what was actually secured and how the image was created.

What data does a forensic image contain?

The content depends on the type of source system and the backup method used. With a classic sector-by-sector backup of a data carrier, all addressable storage blocks can, in principle, be captured.

The following information, among other things, can later be analyzed from this:

• regularly existing files and folders
• File system structures
• Partition tables
• File metadata
• deleted file references
• unallocated memory areas
• File fragments
• user profiles
• System files
• Application databases
• Browser data
• Log and event data

Which of these pieces of information can actually be reconstructed later depends on the file system, storage medium, and the state of the data.

What does "unallocated storage" mean?

Unallocated space, often referred to as "unallocated space", is storage space that is not currently allocated to any active file by the file system.

When a file is deleted, its data does not necessarily disappear completely from storage immediately, depending on the file system. Often, only the file association is removed initially, and the storage space is marked as available again.

As long as this area has not been overwritten or cleared by internal storage mechanisms, fragments of earlier data may still be present. A normal file copy does not capture such areas. A sector-by-sector forensic image, however, can contain them.

Why can a forensic image be important when data has been deleted?

When searching for deleted files, a simple copy of the currently visible files is often unsuitable. It omits those storage areas where remnants of deleted data might still be present.

A forensic image can preserve these areas and allows for later examination without having to continue using the original data carrier.

However, this does not mean that deleted data can be automatically recovered. If the relevant storage areas have been overwritten or removed by SSD-internal cleanup mechanisms, even a complete image cannot restore the original data.

How is a forensic image created?

With traditional storage media, the memory is read using suitable hardware or software and written to an image file or another target format. The backup can be performed directly on suitable forensic storage.

Before starting, the identifying characteristics of the source data carrier are usually documented. These include, among other things, manufacturer, model, serial number and storage capacity.

During the backup process, any read errors or other anomalies that occur are logged. An integrity check can be performed upon completion.

Why is a write blocker used?

With suitable data carriers, a write blocker is often used between the source medium and the examination computer. It is designed to prevent the examination computer from sending write commands to the original data carrier.

This is important because operating systems can make automatic changes as soon as a storage device is connected. For example, index information, file system data, or other metadata can be modified.

A write blocker significantly reduces this risk. However, it is not technically feasible with every device and every backup system.

What role do hash values ​​play?

After the backup process, cryptographic hash values ​​are often calculated. These serve to later verify the integrity of the generated data set.

A hash value can be understood simply as a digital fingerprint of a data set. Even a slight change to the underlying data will very likely lead to a different result with modern hashing algorithms.

If a forensic image is later re-examined and the same hash value is calculated, it can be determined that the hashed data set has not changed since the original calculation.

What does a hash value not prove?

Hash values ​​are often overrated. An identical hash value proves the integrity of a given data set, but it doesn't answer any further questions about the origin or authenticity of the content.

A hash value does not automatically prove, in particular:

• who created a file
• when a file was actually created
• whether the content of a document is true
• who has opened or copied a file
• whether the original data had already been manipulated before the backup.

This distinction is important because integrity and authenticity are different forensic issues.

Which image formats are used?

Forensic images can be stored in various formats. The choice depends on the tools used, the purpose of the investigation, and the requirements for compatibility, compression, and documentation.

RAW or DD image

A RAW image essentially contains a direct sequence of the extracted data blocks. The format is technically simple and supported by many forensic tools.

The advantage lies in its broad compatibility. The disadvantage is that additional case information or internal audit data cannot be embedded in the same way as with specialized container formats.

E01 format

The E01 format originates from the EnCase world and has been used in digital forensics for many years. In addition to the actual data, it can store metadata and audit information and supports compression and segmentation.

This allows a large image to be split into several individual files, for example.

AFF and other formats

Other forensic container formats also exist. The crucial factor is that the chosen format can be reliably processed by the analysis tools used and supports the necessary testing capabilities.

What does image segmentation mean?

Very large forensic images can be split into multiple files. This segmentation facilitates the storage and transfer of large datasets.

An 8 TB storage device does not necessarily have to be stored as a single 8 TB file. The image can technically be divided into numerous smaller segments, which together represent the complete backed-up data.

For analysis, these segments are interpreted by the forensic software as a coherent image.

Can a forensic image be compressed?

Certain image formats support lossless compression. This reduces the required storage space without altering the content of the backed-up data.

The effectiveness of compression depends on the data. Already compressed videos, images, or encrypted data can often only be reduced slightly further. Large areas with recurring or empty data, on the other hand, can be compressed much more effectively.

Lossy compression methods would be unsuitable for a forensic image because they would alter data.

How large is a forensic image?

With an uncompressed sector-by-sector image, the size generally corresponds approximately to the addressable capacity of the source storage medium. A 2 TB hard drive can therefore create an image of approximately 2 TB, regardless of how many visible files are actually stored.

With compressed container formats, the actual storage requirement can be lower. How much lower depends on the data being stored.

When planning a forensic investigation, additional storage space for working copies, analysis indexes, temporary files, and exported results must also be taken into account.

Why does forensics require more storage space than the size of the original data carrier?

The nominal size of the source device is not equal to the total storage requirement of an investigation. In addition to the original image, a working copy, analysis projects, index databases, recovered files, and exports may be created.

Therefore, a 4 TB storage device may require significantly more than 4 TB of working and archive storage.

For professional forensic environments, storage requirements should therefore be planned with sufficient reserves.

What happens in the case of reading errors?

Damaged storage media may no longer reliably provide access to individual storage areas. In this case, the backup tool must be able to handle read errors.

Depending on the method, faulty areas can be logged, read multiple times, or initially skipped. With unstable storage media, a gentle initial backup may be more important than repeated aggressive read attempts.

Reading errors must be documented because they can affect the completeness and meaningfulness of the image.

Is an image with read errors still usable for forensic purposes?

Yes, under certain circumstances. A partially damaged storage medium can still contain large amounts of usable data.

It is crucial to transparently document which areas could not be read. An incomplete backup is not automatically worthless, but it should also not be presented as complete.

How does an HDD image differ from an SSD image?

In traditional magnetic hard drives, the logically addressable storage corresponds relatively directly to the areas that can be read via the interface. This allows deleted data remnants to be retained for longer, as long as the relevant sectors have not been overwritten.

SSDs, on the other hand, use internal flash management. Wear leveling, garbage collection, and TRIM affect the physical storage. The SSD controller decides internally which memory cells are actually used.

A forensic image of an SSD can therefore fully capture the currently addressable logical memory, but does not automatically contain all physically existing states of individual flash cells.

What is the significance of TRIM for a forensic image?

TRIM allows an operating system to inform an SSD that certain data blocks are no longer needed. The SSD can then prepare these areas internally for later reuse.

This allows deleted data to disappear relatively quickly from logically accessible storage. If a forensic image is only created afterwards, it may no longer contain any usable remnants.

The image therefore reflects the state at the time of the backup. It cannot restore data that the storage device has already internally removed.

What applies to NVMe SSDs?

NVMe is a modern interface for fast SSDs. From a forensic perspective, it presents essentially the same challenges as other flash storage devices, particularly regarding internal controller logic, TRIM, and garbage collection.

Additionally, the backup hardware used must support the respective NVMe format and physical interface. M.2 only refers to one possible form factor and does not, on its own, indicate which protocol is used.

Therefore, before removing or connecting a data storage device, it should be carefully checked which technical variant is present.

Can an encrypted data carrier be easily imaged?

Technically, it is often possible to copy an encrypted data carrier sector by sector. However, the result will also contain the encrypted data.

Without the necessary key or access, the image may not be meaningfully analyzed afterwards.

If an encrypted system is already started and unlocked, a different backup strategy may be more appropriate than for a switched-off device.

BitLocker and forensic image

In a Windows system encrypted with BitLocker, a physical image of the powered-off disk can essentially contain encrypted data.

For subsequent analysis, suitable access data or recovery keys will be required. If the system is already unlocked, a logical or live-based backup of the decrypted data may be more appropriate under certain circumstances.

Which option is more forensically appropriate depends on the specific question being asked.

FileVault and forensic image of a Mac

Modern Macs often use FileVault and additional hardware-based security mechanisms. Furthermore, in current Apple Silicon systems, internal storage is tightly integrated with the device architecture.

The traditional approach of removing a hard drive and backing it up separately using a write blocker is therefore no longer possible with many modern Macs.

The backup method must be chosen based on the Mac model, the security status, and the available access data.

Can a forensic image be created from a smartphone?

The term must be used carefully when referring to smartphones. Modern iPhones and Android devices often do not allow direct, full access to the physical flash memory.

Instead, depending on the device and available method, logical extractions, file system extractions, or other technically accessible data sets are generated.

Such an extraction can be forensically valuable and very comprehensive, but it is not automatically equivalent to a sector-by-sector hard drive image.

Why is this distinction important for smartphones?

If a report merely states that a smartphone was "fully mirrored", it remains unclear what the actual amount of data was.

Therefore, technically precise documentation should specify the exact extraction method. Only then can it be assessed which data areas were captured and which may have been inaccessible.

Especially when it comes to the question of deleted data, the extraction method can be crucial.

Can a forensic image be examined later with other software?

Yes, provided the image format used is supported by the respective software. This is one of the biggest advantages of a clean forensic backup.

The original image does not need to be reused. The existing image can later be checked with a different analysis tool or evaluated under a new question.

This also allows for an independent second examination by another expert.

What is a working copy of the forensic image?

The original forensic image can be archived unchanged. An additional working copy is often used for the actual investigation.

This ensures that the original backup is preserved, even if changes are made to files, indexes, or project data during the analysis.

If needed, a new working copy can be created from the archived original image at any time.

Can a forensic image be manipulated?

Like any digital file, an image can theoretically be altered if someone has write access to it. Therefore, access control, secure storage, and integrity checks are important.

If a cryptographic hash value was documented for the original image, a subsequent change would normally result in a different hash value.

However, this requires that the original reference value itself has been reliably documented and protected.

How is a forensic image securely stored?

A forensic image can contain highly sensitive information. It often contains significantly more data than is actually needed for the specific investigation.

Therefore, storage should be protected against unauthorized access. Depending on the protection requirements, encrypted storage systems, access restrictions, logging, and physical security measures can be useful.

Backup copies must also be included in the protection concept.

How long should a forensic image be kept?

There is no universally applicable retention period for every investigation. The duration depends, among other things, on the nature of the investigation, legal proceedings, contractual agreements, data protection regulations, and potential evidentiary issues.

It is important to clarify, either before or during the investigation, what should happen to the original, image, working copies and exported data after completion.

What errors frequently occur in forensic images?

• The image is saved without a clear association to the original.
• Serial number and device data are not documented.
• The source data carrier is mounted for writing without any need.
• Reading errors are not logged.
• The backup method used is not mentioned.
• It is generally referred to as a "1:1 copy", although only a logical backup exists.
• Hash values ​​are calculated, but not properly documented.
• The original image and working copy are not separated.
• The image is stored on insufficiently protected storage media.
• The available storage space is misjudged before the start.

Practical example: 1 TB hard drive of a company computer

There is a strong suspicion that company data was copied onto a USB stick from a company computer before an employee left the company. The internal storage device has a capacity of 1 TB.

A normal copy of the user folders would only capture the currently visible files. However, information about connected USB devices, file system artifacts, deleted files, and other system data may also be relevant for the investigation.

A suitable forensic image provides a significantly broader basis for investigation. Subsequent analysis can then be performed on a working copy, while the original image remains archived unchanged.

Practical example: Deleted project files

A company discovers that a directory containing important project documents has been deleted. The computer has a traditional magnetic hard drive.

A standard backup of currently visible files would not include deleted directories. A sector-by-sector backup, however, can also include unallocated storage areas.

Whether the deleted files can actually be recovered depends on whether the relevant storage areas have already been overwritten. However, the forensic image at least provides the basis for investigating this question.

Practical example: SSD after data deletion

Files were deleted on a modern notebook with an NVMe SSD. An investigation was only commissioned several days later.

A forensic image can also be created here. However, it should not be expected that it will automatically contain all deleted data.

TRIM and garbage collection may have already cleaned up the freed memory areas. The value of the image still lies in its ability to create a controlled backup of the currently accessible state and prevent further changes from normal use.

Practical example: Second opinion

In a legal proceeding, the technical assessment of a previous investigation is being challenged. The original device is no longer available, but the forensic image created at the time was archived with documented hash values.

A second expert can re-examine this image and check whether the original conclusions are actually supported by the data.

This example demonstrates a key advantage of a cleanly generated forensic image: The investigation can be reproduced and independently verified.

When is a forensic image particularly useful?

A forensic image is particularly useful when a data carrier is to be examined in detail later and the original must be preserved as much as possible.

• Suspected data theft
• Investigation of deleted files
• Suspected data manipulation
• Analysis of user activities
• Testing connected external storage devices
• Cybersecurity Incidents
• legal disputes
• Securing evidence before returning a device
• Preparation for a later review
• The need for an independent second analysis

When is a forensic image alone insufficient?

An image is a data basis, but not yet a result of an investigation. It does not automatically answer the actual question of proof.

Only the analysis of the data and its technical evaluation allow for conclusions to be drawn about a situation. This requires comparing different artifacts and considering possible alternative explanations.

Furthermore, information may reside outside the depicted data carrier, for example in cloud services, on servers, in email systems, or on other end devices. A single image therefore does not necessarily represent the entire situation.

Frequently asked questions about forensic imaging

Is a forensic image an exact copy?

With a traditional sector-by-sector backup, the logically addressable storage can be mapped very completely. However, with modern SSDs, smartphones, and other complex storage systems, it is necessary to precisely describe at which level the backup was performed.

Does a forensic image contain deleted data?

It may contain storage areas where fragments of deleted data still exist. Whether these can actually be reconstructed depends on the storage medium and its condition.

Can an image be larger than the stored files?

Yes. An uncompressed sector-by-sector image is based on the capacity of the storage medium and not just on the total number of visible files.

Can a forensic image be compressed?

Yes, if a suitable lossless image format is used. The original data must not be altered in any way.

Can an image be stored on a normal hard drive?

Technically, yes. However, for professional investigations, the target medium should be sufficiently large, reliable, and adequately protected against unauthorized access.

Does a hash value need to be created for each image?

For evidence-relevant backups, a documented integrity check is technically advisable. The specific hashing strategy used depends on the workflow and the purpose of the investigation.

Can an image be re-examined years later?

Yes, provided it was preserved completely and legibly, and the file format is still supported. This is a significant advantage over a single analysis of the original device.

Can an image be used to determine who copied a file?

Not solely based on the existence of the image. Such a statement requires the analysis of specific user, file, device, and system traces. In some cases, a clear personal identification is technically impossible.

Why a forensic image is more than a copy

The crucial value of a forensic image lies not merely in the fact that data is duplicated. It creates a defined technical basis for subsequent investigation.

A well-created backup allows for repeated analysis of a saved data state, the use of different tools, and the subsequent verification of results by another investigator. At the same time, the original device can be largely excluded from further analysis after the backup has been created.

This makes the forensic image a crucial link between evidence preservation and analysis. However, its significance depends directly on how precisely the origin is documented, which preservation method is chosen, and how reliably the integrity of the data set has been maintained.