Disk Imaging

Please help to improve this article by expanding it. Further information might be found on the discussion page.

Disk imaging is the process of making a bit-by-bit copy of a disk. Imaging (in more general terms) can apply to anything that can be considered as a bit-stream, e.g. a physical or logical volumes, network streams, etc.

The most straight-forward disk imaging method is reading a disk from start to end and writing the data to a Forensics image format. This can be a time consuming process especially for disks with a large capacity.

Also see

Forensics File Formats

External Links

• Benchmarking Hard Disk Duplication Performance in Forensic Applications, by Robert Botchek

Hash based imaging

• Hash based disk imaging using AFF4, by Michael Cohen, Bradley Schatz