thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

Forensic Image

A bit-for-bit copy of a storage device, including unallocated space and slack, used for analysis instead of the original.

Definition

Forensic images capture every sector, preserving deleted files and remnants, and are stored in formats such as raw (dd), E01 (EnCase) or AFF4. Images are hashed and verified against the source. Analysts work on copies to preserve the original.

Example

dc3dd if=/dev/sdb of=evidence.dd hash=sha256 log=acq.log

Exam tip

A logical copy misses deleted data; forensic images are bit-level.

Related terms