Forensic Image

Definitions

1. A bit-for-bit copy of a storage device created in a way that preserves evidence and supports later verification, usually with hashing and careful documentation. A forensic image captures deleted space, slack space, and metadata that normal file copies miss.

   In plain English: An exact evidence-grade copy of a storage device.

   Example: "Before touching the drive, the team created a forensic image and recorded the hash values."

Related Terms

• Disk Forensics
• Email Header Analysis
• Forensic Analysis
• Forensic Artifact
• Forensic Investigation
• Forensic Workstation
• Image Forensics
• Intrusion Analysis
• Packet Analysis
• Payload Analysis