Forensic data backup is the methodically controlled preservation of digital data with the aim of creating the most reliable and verifiable basis possible for later investigation. It differs from ordinary data backup primarily in that not only the content is preserved, but also its origin, integrity, backup method, and technical parameters are documented.

The focus is therefore not on how data can be copied as quickly as possible. Rather, the crucial question is what data source is available, what information might be relevant to the investigation, and how this data can be backed up without unnecessarily altering the initial situation.

Forensic data preservation can vary significantly depending on the device. For a traditional hard drive, sector-by-sector imaging might be appropriate. A smartphone, on the other hand, may require file system extraction or another technically available acquisition method. A live server, in turn, might necessitate a live backup. There is no single backup method suitable for all digital evidence.

What exactly does forensic data backup mean?

Forensic data preservation means capturing digital data in such a way that it can be used as reliably as possible for later technical investigation. This includes more than just copying files. Depending on the system, file system structures, metadata, areas not immediately visible, system information, databases, or other technical artifacts may also be relevant.

A professional backup should primarily achieve three goals: to preserve the state of the data as best as possible, to control or minimize changes, and to document the entire backup process in a traceable manner.

This makes the securing process itself part of the forensic methodology. A subsequent analysis can only be as reliable as the data on which it is based.

Why isn't a regular copy always sufficient?

A standard file copy typically only captures files and folders that are visible and accessible to the operating system. For many everyday situations, this is perfectly adequate. However, for a forensic investigation, this may be insufficient.

A simple copy can result in the loss of information that might be relevant for reconstructing a case. Depending on the system, this could include, for example, file system information, deleted file references, unallocated memory areas, certain metadata, or traces of previous use.

Furthermore, even the normal act of opening, copying, or moving files can alter timestamps or other system information. Therefore, forensic data backup considers not only the visible content but also the technical methods used to back up data.

What is the difference between backup and forensic data recovery?

A backup primarily serves to restore data after loss, damage, or failure. It should enable the resumption of normal business operations or personal data use.

A forensic data backup pursues a different goal. Here, the focus is on subsequent investigation. Therefore, information that would be irrelevant for a normal backup can also be relevant.

• Backups usually focus on usable files and systems.
• Forensic evidence can capture additional technical structures.
• Documenting the backup process is essential for forensic evidence preservation.
• Integrity checks play a more significant role.
• The handling of the original is more strictly controlled.
• The ability to trace the origin of the data at a later date is crucial.

An existing backup can still be a valuable forensic data source. However, it does not automatically replace a targeted forensic backup of the original system.

What is a forensic copy?

The term "forensic copy" is used in different ways. In a narrower sense, it can refer to a copy of a data carrier that is as complete as possible and used for later examination. A forensic image is often created for this purpose.

It's important not to use the term too broadly. With a traditional hard drive, a sector-by-sector image can be technically useful. However, with modern smartphones, encrypted systems, or cloud services, there is no identical form of a traditional hard drive copy.

Therefore, it should always be specifically described what type of security measures were actually implemented.

What is a forensic image?

A forensic image is a structured representation of a data storage medium or data set that can subsequently be examined. With traditional data storage media, this can involve a sector-by-sector scan of the addressable storage.

Depending on the format used, additional metadata for backup, checksums, compression, or segmentation may be included. The image then serves as the basis for analysis, so that the original does not need to be reused for every analysis.

However, a forensic image is not a magic formula for a "perfect copy." Actual completeness depends on which areas were technically accessible and which backup method was used.

What does "bitwise" or "sector-wise" backup mean?

In a sector-by-sector backup, the addressable storage of a data carrier is read block by block. Unlike a normal file copy, this process does not only access the logically visible files.

Under certain conditions, this means that file system structures, unallocated storage areas, or fragments of deleted data may also be included in the backup.

This can be particularly relevant for later data recovery with traditional hard drives. However, SSDs and flash storage devices have additional technical limitations, especially due to memory management, TRIM, and internal controller logic.

Is a 1:1 copy always truly 1:1?

The term "1:1 copy" is frequently used, but can be misleading. With a traditional, directly addressable storage medium, a sector-by-sector copy can be very close to a complete representation of the accessible memory.

The situation is more complex with modern storage systems. SSD controllers manage memory cells internally, defective areas are remapped, and certain physical areas are not directly visible to the operating system. Even in smartphones, there is a significant difference between the logical data layer and physical storage.

Therefore, the statement "1:1 copy" only makes sense if it is clearly described at which technical level the copy was created.

What types of forensic data backup are there?

The appropriate backup method depends on the device, operating system, security status, and the specific issue at hand. Various methods are used in practice.

Logical backup

A logical backup captures data that is accessible via the operating system, an interface, or an application. This can include files, contacts, messages, documents, or other logically provided data.

This method can be fast and technically gentle, but it usually does not capture all underlying data structures.

File system backup

A file system backup captures not only selected visible files, but larger parts of the file system structure. Especially on mobile devices, this can produce significantly more artifacts compared to a purely logical backup.

The actual data contained depends on the device, operating system, and access method.

Physical or sector-based security

With suitable storage media, the addressable memory can be scanned sector by sector. This method can reveal additional information that would not be available in a normal file copy.

However, with modern encrypted devices and smartphones, such security is not always technically available or meaningfully interpretable.

Live backup

A live backup involves examining or backing up a running system. This may be necessary, for example, if data can only be decrypted and accessed while the system is running, or if volatile information needs to be captured.

The disadvantage is that every access to a running system causes changes. These cannot be completely avoided and must therefore be monitored and documented.

Cloud backup

Cloud data can be backed up via exported data sets, APIs, local synchronization data, or other access methods, depending on the service.

Here too, it must be documented how the data was obtained and what scope the backup actually represents.

When is a write blocker used?

A write blocker prevents an investigation computer from writing data to an attached storage device. For traditional hard drives, USB drives, or other suitable media, this can be an important part of data backup.

Hardware write blockers are physically located between the storage medium and the forensic system. Software-based solutions attempt to prevent write access at the operating system level.

However, a write blocker is not a universal tool for every device. Smartphones, running systems, soldered-on memory, or certain modern storage media require different backup strategies.

Why is the condition of the device before the backup so important?

The state of a device can influence the entire backup strategy. A powered-off, encrypted computer presents different requirements than a system that is already booted and unlocked.

A running device may contain keys, decrypted data carriers, active network connections, or temporary information that is lost after it is switched off.

On the other hand, every further operation of a system modifies data. Therefore, the decision between immediate shutdown, live backup, or controlled continued use is a professional assessment and not a standard decision.

Why shouldn't a switched-on device be reflexively switched off?

The commonly given advice to immediately switch off a device if you suspect a security breach is not correct in every situation. With an encrypted computer, switching it off can render the storage medium inaccessible without login credentials.

Even volatile information stored in RAM can be lost. Furthermore, continuing to operate the system during an ongoing cyberattack can cause additional damage.

The appropriate course of action therefore depends on the specific situation. Especially when dealing with important evidence, a formulaic approach should be avoided.

What is the significance of RAM?

RAM is volatile. When a system is switched off, its contents are usually lost. However, in certain investigations, it may contain relevant information.

This can include ongoing processes, network connections, decrypted data components, or other temporary information.

In certain cases, backing up the RAM before shutting down can therefore be advisable. However, this is an active measure and modifies the system. Here, too, it must be weighed whether the potential gain in knowledge justifies the intervention.

How is a Windows PC forensically secured?

Depending on the hardware, it may be possible to directly back up the data storage device when a Windows PC is switched off. Various forensic hardware and software methods can be used with traditional SATA or NVMe storage devices.

If the computer is switched on and the storage medium is encrypted, a live backup can be useful. The method chosen depends on factors such as BitLocker, hardware configuration, device status, and the objective of the investigation.

A blanket statement like "remove the hard drive and copy the data" may therefore fall short with modern systems.

How is a Mac forensically secured?

Modern Macs differ significantly in their technical design from older computers with easily removable hard drives. In current Apple systems, SSDs, security architecture, and encryption can be closely integrated.

FileVault and hardware-based security features significantly affect access options. With Apple Silicon systems, a traditional upgrade of the storage medium is practically impossible.

The backup strategy must therefore be adapted to the specific Mac model, the power-on state, and the available access options.

How is a smartphone forensically secured?

With smartphones, the term "data extraction" is often used rather than "classic imaging." Modern iPhones and Android devices are strongly encrypted and have complex security architectures.

Depending on the device, different extraction methods may be available. For example, a logical backup yields a different amount of data than a file system extraction.

For smartphones, it's also relevant whether the device is locked or unlocked and what its security status is. Even a restart can change the access options.

What do BFU and AFU mean in the context of smartphones?

Modern smartphones often distinguish between the state before the first unlock after a restart and the state after a successful unlock. In technical terms, these are frequently referred to as "Before First Unlock" and "After First Unlock".

This difference can be crucial because certain cryptographic keys and data accesses only become available after successful user unlocking.

Therefore, an unnecessary restart of an already unlocked smartphone can significantly alter the forensic possibilities.

How are external hard drives and USB sticks backed up?

External storage media often allow for direct sector-by-sector backups. A write blocker can prevent the computer performing the analysis from writing to the original.

Before backing up the data, the manufacturer, model, serial number, storage capacity and visible condition should be documented.

Once the backup is complete, a hash value can be calculated and logged to later verify the integrity of the generated copy.

How are SSDs secured forensically?

SSDs can generally be forensically secured, but they differ significantly from traditional magnetic hard drives in terms of technology. Internal controllers, wear leveling, garbage collection, and TRIM all affect which data areas are actually accessible.

A sector-by-sector copy can capture the currently addressable data. However, it does not mean that all information ever stored on the flash cells is accessible.

This is particularly crucial when dealing with deleted data. TRIM can render released storage areas unusable for meaningful reconstruction.

Why is TRIM relevant for a fuse?

TRIM informs an SSD which memory areas are no longer needed by the operating system. The controller can then clean up these areas internally.

This means that deleted data on SSDs can be permanently lost more quickly than on traditional hard drives.

Therefore, continuing to use a system after data deletion can further reduce the chances of later reconstruction.

What role do hash values ​​play in forensic evidence collection?

Hash values ​​are used to verify the integrity of a secured dataset. A checksum is calculated from the data using a cryptographic method.

If the same data set is hashed again later and the same value is obtained, this suggests that the data in question has not changed since the original calculation.

Hash values ​​should be interpreted correctly, however. They do not prove who created the data, whether the content is true, or when a file was created. They primarily serve for integrity control.

Which hash algorithm is used?

Historically, digital forensics used methods such as MD5 and SHA-1. Modern integrity checks often employ more robust methods like SHA-256.

The choice of method should be documented in a traceable manner. In certain workflows, multiple hash values ​​can also be calculated in parallel.

More important than simply mentioning an algorithm is clearly documenting what amount of data was hashed and at what time.

What is documented during a forensic data backup?

The documentation should allow the backup process to be traced later. The specific information required depends on the case.

• Description of the evidence
• Manufacturer and model
• Serial number or other identifying features
• Storage capacity
• external condition
• On state
• Date and time of takeover
• Date and time of backup
• backup method used
• hardware and software used
• relevant version levels
• used image format
• calculated hash values
• any errors or read errors that occurred
• special technical circumstances

Why do backup errors need to be documented?

Not every storage medium can be read completely without errors. Damaged sectors, defective memory cells, unstable hardware, or interface problems can lead to individual areas not being read.

Such errors must not go unnoticed. They can affect the later validity of the findings and must therefore be documented in the backup protocol.

A transparent backup is more valuable from a technical standpoint than a seemingly perfect backup where technical problems have not been documented in a traceable manner.

What is a working copy?

After the actual forensic preservation, an additional working copy can be created. The analysis is then performed on this copy.

The original image can be archived unchanged. If a file is modified during analysis, or if software accidentally writes to it, the original backup will be preserved.

This approach can improve the traceability and repeatability of an investigation.

Why not work directly on the original?

Any direct access to an original document carries the risk of alteration. Operating systems can automatically write metadata, create index files, or modify timestamps.

If technically possible, a suitable backup is therefore created first, and the analysis is then performed on a copy.

However, with smartphones and live systems, accessing the original is often unavoidable. In these cases, the procedure must be adapted accordingly and documented.

What is live lead generation?

Live acquisition is the process of backing up data from a running system. It is used when certain information is only available while the system is active.

This can include, for example, decrypted drives, volatile memory contents, active processes, or network connections.

The main disadvantage is that the backup process itself alters the system. Every command executed and every tool launched creates new traces. Therefore, live data acquisition must be planned and documented with particular care.

When is a live backup useful?

A live backup can be useful, for example, if an encrypted drive has already been unlocked and might no longer be accessible after being switched off.

Live acquisition may also be necessary with running servers, virtual systems, or an active cyberattack.

The decision always involves weighing the protection of the existing state against the potential loss of important volatile data.

How can cloud data be secured in an legally compliant manner?

Cloud data presents unique challenges because the data does not necessarily reside on a physically controlled storage medium. The actual storage location may be outside the investigator's direct control.

Depending on the service, export functions, programming interfaces, synchronization folders, local cache data, or administrative logs can be used.

Documenting the retrieval time, account used, access path, and data volume is particularly important. Since cloud content can be dynamically modified, the timing of the backup is of paramount importance.

Can a forensic backup remain completely unaltered?

For certain traditional data storage media, a write-protected backup can come very close to this ideal. However, absolute freedom from alteration cannot be guaranteed for all digital systems.

Even unlocking, data extraction, or system communication on a smartphone can cause changes. Similarly, the tools used in a live backup of a computer also generate new data.

The technically correct statement is therefore not "Nothing was changed," but rather which changes were avoided, which were technically unavoidable, and how these were documented.

Can a faulty fuse destroy evidence?

Yes. Incorrect actions can alter relevant data or render it permanently inaccessible.

Particularly problematic can be a new installation, a reset of the device, a system cleanup, data recovery software on the original data carrier, or further intensive use of a system.

On SSDs and smartphones, previously deleted data can be permanently lost as a result. Therefore, before any major interventions, it should be checked whether a forensic backup is necessary.

Why shouldn't data recovery software be installed on the original device?

Those who want to recover accidentally deleted data often install data recovery software directly on the affected computer. This can be problematic.

The installation process creates new files and may overwrite free storage space. However, fragments of the deleted data might still be present there.

From a forensic perspective, a relevant data carrier should therefore be backed up as soon as possible before any recovery attempts are made.

What happens if a data storage device is damaged?

The backup strategy must be adjusted for physically or logically damaged storage media. Repeated normal read attempts can further strain an unstable storage medium.

In such cases, a prioritized or fault-tolerant backup may be useful, in which as many readable areas as possible are captured first.

In cases of severe physical damage, specialized data recovery may be necessary. The forensic objective should be clearly communicated before any measures are taken.

How much storage space does a forensic backup require?

Storage requirements can be substantial. A sector-by-sector backup of a 4 TB hard drive can easily require several terabytes of storage space. This is in addition to working copies, exported data, analysis indexes, and reports.

With multiple devices, the actual storage requirement can therefore be significantly higher than the sum of the nominal device sizes.

A professional forensic environment must take this need into account before the backup process and provide sufficient secure storage.

How are forensic evidence files stored?

Forensic evidence files can contain highly sensitive personal and business data. Therefore, the requirements for access control and secure storage are correspondingly high.

Depending on the protection requirements, encrypted storage systems, separate access rights, logging and physical security measures may be necessary.

It should also be stipulated how long data is stored and when it is deleted or returned to the client.

How is the identity of a data carrier ensured?

An important part of documenting evidence is the unambiguous identification of the device under investigation. Where possible, unique identifying characteristics are recorded for this purpose.

Manufacturer, model, serial number, capacity and other technical information can help to avoid confusion.

Clear identification is particularly important when dealing with several similar-looking devices.

What does "Chain of Custody" mean in the context of data backup?

The chain of custody describes the traceable chain of evidence. It documents who took possession of, secured, examined, stored, or passed on a device and when.

The technical quality of a backup alone is not sufficient if it is later unclear from which original the data originated or who had access to it.

A clean chain of evidence therefore combines technical security with comprehensible organizational documentation.

When should a forensic data backup be performed?

Forensic preservation is particularly useful when digital data could later become relevant for technical reconstruction or legal evaluation.

• Suspected data theft
• Suspected unauthorized data copying
• Dismissal of an employee in case of concrete suspicion
• Deletion of important company data
• Suspected manipulation
• Cyberattack or malware incident
• potential evidence on a smartphone
• legal disputes
• Suspected unauthorized account access
• Examination of emails or messenger data
• Possible recovery of deleted files

When is a complete backup not advisable?

Not every investigation necessarily requires a complete sector-by-sector backup of all existing systems. For very large infrastructures, server landscapes, or cloud environments, a targeted backup approach may be more appropriate.

The decisive factor is the question being asked. If only a narrowly defined data set is relevant, a controlled selective backup may suffice, provided that no information essential to the task is lost as a result.

Forensics, therefore, does not automatically mean collecting as much data as possible. A good data preservation strategy captures the data necessary for a reproducible investigation.

What are typical errors in forensic data backup?

• working directly on the original without need
• missing documentation of the initial state
• no unique device identification
• unnecessary starting or restarting of a device
• Disabling an already decrypted system without prior verification
• Installation of data recovery software on the affected storage medium
• lack of integrity control
• unclear description of the securing method
• Insufficient storage space during backup
• Failure to document reading errors
• Mixing of original, backup and working copy
• Lack of access control to sensitive backup data

Practical example: Suspicion of data copying before termination

A company suspects that an employee copied confidential project and customer data shortly before leaving the company. The company laptop in question is still in daily use.

If the computer were to continue operating for several weeks, relevant system information could be overwritten. Conversely, an immediate and uncontrolled search for suspicious files would also create new traces.

A sensible approach might be to document the current state and first create a suitable forensic backup. This backup can then be examined to determine which USB devices were connected, which files were used during the relevant period, and whether there are any further technical indications of data transfers.

The added value of forensic data preservation lies not only in copying files. It freezes the data relevant to the investigation, as far as technically possible, at a specific point in time, enabling later analysis without having to continuously use the company laptop as the primary source of information.

Practical example: Deleted files on an SSD

A user notices that important files have been deleted on a laptop, and then continues working normally for several days. The device has a modern SSD.

Each additional write operation can reduce the chances of recovery. Additionally, TRIM and internal garbage collection can modify released areas.

Early backup can therefore be crucial. While it doesn't guarantee that deleted data can be recovered, it at least prevents unnecessary additional changes from occurring through further normal use.

Practical example: Mac switched on with FileVault

The Mac is powered on, unlocked, and the user is logged in. The internal storage is protected with FileVault.

A knee-jerk shutdown can lead to data that can subsequently only be decrypted with the necessary access credentials. Therefore, in certain situations, a controlled backup while the system is running may be more sensible than an immediate shutdown.

This example illustrates why blanket rules are problematic for digital evidence preservation. The device's condition is part of the evidentiary situation and must be considered before any action is taken.

Practical example: Smartphone with relevant messenger data

Messages and app data on a smartphone are to be examined. The device is switched on and unlocked.

A restart can change the security state and make certain data access more difficult. At the same time, any further normal use can generate new data.

The correct procedure therefore does not necessarily involve switching off the device or continuing to use it. First, it is necessary to check the device's current state and what extraction options are available for the specific model and operating system.

Frequently asked questions about forensic data backup

Is a forensic backup always a complete copy?

No. The extent depends on the device and the method used. A sector-by-sector backup of a hard drive can be very comprehensive, while a logical smartphone extraction only includes certain accessible data.

Can a forensic backup contain deleted data?

Under certain conditions, yes. Sector-by-sector backups can also include unallocated storage areas. However, whether deleted data can be recovered from these areas depends on the storage medium and its condition.

Is a write blocker always necessary?

No. Write blockers are useful on suitable storage media, but not on every device. Smartphones, running systems, or permanently installed storage require different methods.

Does the fuse alter the original?

With traditional storage media, a read-only backup can largely prevent changes. With smartphones or live systems, technically induced changes cannot always be completely ruled out.

Why are hash values ​​calculated?

Hash values ​​enable subsequent integrity checks of the backed-up data. They help to verify whether a data set has been modified since the calculation.

Can a normal Windows copy be used as a forensic backup?

Possibly for simple document backup. For a comprehensive forensic investigation, a normal file copy is often insufficient because additional file system and storage information can be lost.

Can a fuse be examined again later?

Yes. That's precisely where a major advantage lies. A correctly archived forensic backup can later be re-analyzed with different tools or under a new question, without having to reuse the original.

How long must a forensic evidence file be kept?

There is no general deadline for this in every case. Retention periods, legal purposes, data protection, and contractual agreements must be taken into account.

The real value lies in the quality of the security.

Subsequent analysis can only be as reliable as the data on which it is based. Therefore, forensic data backup is one of the most important steps in a digital investigation.

A good backup strategy doesn't simply capture as much data as possible. It takes into account the technical condition of the system, selects a suitable acquisition method, documents necessary interventions, and ensures that the origin and integrity of the data under investigation can be traced later.

Especially with modern smartphones, SSDs, encrypted computers, and cloud systems, there is no one-size-fits-all method. Professional digital forensics therefore means choosing the security strategy for each piece of evidence that best suits the technical conditions and the specific question at hand.