Glossary term
Forensic Image
A forensic image is a bit-for-bit copy of a storage device that captures every byte, including active files, deleted content, slack space, and unallocated space, with hash verification.
A forensic image is the foundation of every forensic analysis. The image is a complete representation of the source media at the moment of acquisition. The original is preserved untouched; analysis is performed on the working copy created from the image.
Common image formats include E01 (EnCase format) with built-in hash verification and compression, AFF (Advanced Forensics Format), and raw DD images for cases where format-agnostic compatibility is required.
A forensic image differs from a regular backup. A backup copies user-visible files. A forensic image copies every bit of the source media, including the unallocated space where deleted file content lives.
For Canadian litigation, the forensic image is what supports the admissibility of any subsequent finding. Counsel can produce the image to opposing counsel for independent verification, and any disagreement at the analysis level can be resolved by re-examining the same image.