What is securing the image?

Securing the image is about preservation. Deleted data can be overwritten at any time. Every time the computer is turned on, latent data is overwritten. And once the latent data is overwritten, for all practical purposes, it's gone forever. Only a forensic image preserves the status quo and preserves latent data.

The process of forensic imaging...

For an image to be forensically sound, it must meet certain criteria:

• First, the process of creating the image must not alter the data in any way.



• Next, the image itself must be treated as real evidence and proper chain-of-custody must be maintained.



• Finally, and perhaps most important, the image must be verified as perfectly identical to the original by something called a hash. A hash is a digital fingerprint created by a forensic investigator. The chances of two different objects having the same MD5 hash value are around 1 in 340 undecillion. That's more than a billion billion times more unlikely than two people having the same DNA!

The importance of forensic imaging...

Forensic imaging of hard drives will preserve valuable evidence. A simple back up copy is not sufficient and IT people are rarely qualified to create a forensic image. Certified forensic investigators have the proper tools and training to secure the image in such a way as to ensure that any important evidence retrieved from the image will be admissible in court.