Once volatile data is captured, the next step is to preserve storage media. The rule is that you never analyze the original. Instead you create a forensic image: a bit-for-bit copy of the entire device, including unallocated space, slack space and deleted file remnants, not just the visible files. A normal file copy misses this hidden data and changes metadata such as access times, so it is not good enough for an investigation.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 5 more sections, 4 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.