www.ExpertDataForensics.com
Tel: 888-355-3888
eForensic Focus
Forensic Imaging & Hard Drive Cloning
Getting the information you need for a case should be done in any way legally possible. If you have a computer with important data that could help you win a case, you will most likely need to clone the hard drive or use forensic imaging, so that you can review it on your own time.
Forensic Imaging & Hard Drive Cloning
Hard drive cloning is the process of copying content from the computer’s hard disk to an image file (also known as Bit stream imaging); this is done using hard drive cloning equipment.
There are various reasons to use this technique, such as for system backups, provisioning new computers, reboot and restore, full system backups and system recovery, but it is also widely used for legal purposes.
Forensic imaging is created using a computer forensic examiner’s lab computer/laptop with special software. Basically, the examiner connects a write blocker to the drive of the subject’s computer and all the content is captured as an image, known as a bit stream image. It is transferred to a separate hard drive. In some processes, multiple forensic images are captured on one single hard drive.
The difference between hard drive cloning and forensic imaging is that one allows you to explore, while the other only allows you to view. With cloning, everything is being copied, so you’re able to access and click through the files on your own hard drive. Forensic imaging captures everything on the original drive. It is a thumb print of the drive. Another major difference is that the files in forensic imaging can’t be accessed using most electronic discovery software or litigation
support applications. Forensic images are only accessible by computer forensic software. Cloning allows you to review it any laptop or desktop that can connect to the hard drive the files were copied to.
(c) Expert Data Forensics
