Disk image

From ForensicsWiki
Revision as of 10:38, 16 July 2008 by Rgautier (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Creating a disk image is important in forensics prior to analyzing anything in order to ensure that disk information is not inadvertantly changed during analysis. By performing an original disk image and storing the original disk, it is possible to reproduce forensic test results with an exact reproduction of analysis methods.