Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Training Camp • Cybersecurity Glossary
A forensic image is a verified bit-stream copy of a drive, capturing all sectors and slack space to preserve digital evidence with hash integrity.
Forensic Image Definition: A forensic image is a verified bit-stream copy of a drive, capturing all sectors and slack space to preserve digital evidence with hash integrity.
A forensic image is a bit-for-bit copy of a storage device that captures every sector, including allocated files, deleted data, slack space, and unallocated regions. Created with write-blockers and tools such as dd, FTK Imager, or EnCase, the image preserves the original evidence in a read-only state so analysis is performed on the copy. A cryptographic hash such as SHA-256 is computed before and after acquisition to prove the image is an exact, unaltered duplicate for chain-of-custody integrity.
Turn knowledge into credentials with our instructor-led cybersecurity boot camps.
View All Courses →