A forensic copy is the starting point of almost every analysis of computers and storage media. Unlike an ordinary file copy, it reproduces the entire content of the medium, sector by sector, including the areas the operating system considers empty. That is often where fragments of deleted files, old versions of documents and traces nobody thought they had left are found.
File copy versus bit-for-bit copy
When you drag a folder onto a USB stick, the system copies only the visible files, and in doing so may change some dates. Unallocated space, system areas and deleted but not yet overwritten files are left out.
A bit-for-bit copy, also called a bit-stream image, instead reads every single sector of the drive from start to finish and writes it to an image file or another medium. The result is a complete duplicate on which every analysis can be performed without ever touching the original.
| Aspect | File copy | Forensic copy |
|---|---|---|
| Visible files | Yes | Yes |
| Recoverable deleted files | No | Yes, if not overwritten |
| Unallocated space | No | Yes |
| File system metadata | Partial | Complete |
| Integrity check | Rarely | Always, with hashes |
The write blocker
Connecting a drive to a computer is not a neutral act. Many operating systems, as soon as they detect a new volume, write indexing files, update logs, mount partitions and sometimes attempt automatic repairs. Each of these writes alters the original.
A write blocker is a device placed between the drive and the acquisition computer that lets only read commands through and blocks any write. There are two families:
- hardware write blockers: small units with ports for SATA, NVMe or USB drives that block writes electronically. They are the preferred choice because they do not depend on software;
- software write blockers: settings or programs that prevent the system from writing to the device. They are useful when there is no alternative, but must be checked carefully, because an update or a wrong setting can cancel their effect.
Before using a write blocker on real evidence, it is good practice to test it on a sample drive, checking that the hash stays identical after connection.
Image formats
The image can be saved in several formats:
- raw (or dd): an exact copy with no compression or extra information. Almost every tool can read it, but it takes up as much space as the whole drive;
- E01 (Expert Witness Format): a very common format that supports compression, splitting into segments and embedded metadata such as case number, examiner name and notes;
- AFF4: an open format designed for large data volumes and more complex acquisitions.
The choice depends on the tools you will use and on storage needs. What matters is that the format is documented and verifiable.
The procedure step by step
- Photograph the device and record make, model, serial number and capacity.
- Remove the drive from the computer if possible, or prepare a forensic boot system that does not mount volumes.
- Connect the drive through a write blocker to the acquisition computer.
- Calculate the hash of the original drive.
- Start the acquisition to a clean destination medium of adequate capacity.
- When it finishes, calculate the hash of the image and compare it with the original.
- Record everything: times, tools and versions, hashes, any read errors.
If the drive has damaged sectors, the tool reports them. These errors must be recorded, because they explain any hash differences and help assess what data might be missing.
The SSD problem
Solid-state drives work differently from mechanical disks. Their controller manages data placement internally and, through the TRIM command and so-called garbage collection, can permanently erase blocks the system has marked as free, even without any external write.
There are two practical consequences. First, an SSD should be acquired as soon as possible, because time works against the recovery of deleted data. Second, in some cases two successive acquisitions of the same SSD can produce different hashes even with a write blocker. This is not operator error but device behaviour, and it must be explained in the report.
Encrypted drives and running systems
If the computer is on and the drive is encrypted, switching it off may make the data inaccessible without the key. In such cases a live acquisition of the already unlocked volumes and of memory is considered. It is a delicate choice that partly changes the system state and must be justified and documented.
In short
- A forensic copy reproduces every sector of the drive, including free space and deleted data.
- A write blocker prevents any write to the original during acquisition.
- The most common formats are raw, E01 and AFF4, all verifiable with hashes.
- Read errors and SSD peculiarities must be recorded and explained.
- With running systems and encrypted drives, switching off without thinking can lose everything.