If you are new to the world of digital forensics, you may come across the term “forensic image.” What exactly is a forensic image? A forensic image is a bit for bit copy of the source device and is stored in a forensic image format. A forensic image allows you to conduct your investigation on an exact copy of the source device. Now your source device may be a thumb drive, hard drive, or SSD drive.
You do not want to do your exam on the original evidence due to its fragility. It is very easy to change digital evidence inadvertently. Using a forensic image protects the data during the examination, so we cannot accidentally change the data. Some standard formats of the forensic image are DD, E01, and AFF.
DD is one of the oldest imaging tool available for forensic investigators. It originally was a UNIX command but has now been migrated to all the major operating systems. There are now unique versions of DD that you can use, one of the more common versions is dc3dd, has been developed by Jesse Kornblum.
Defending Service Members Globally
Wherever Duty Calls, Our Defense Follows
