Forensics imaging is the
process of making an exact copy of a hard drive and or some other type of
media. During the process, every 0 and 1 on the original disk/media is copied
to the target disk/media. Prior to performing imaging, the destination drive
must be zeroed or blanked (whereismydata.wordpress.com, 2009).
The image below shows an
image being acquired with the AFF extension using GUYMAGER.
Reference:
http://cs.harvard.edu/malan/publications/aff.pdf
In this series
Working with media - Unallocated Space
Working with media - Allocated Space
Working with media - Partitioning
Working with media - Sectors
Working with media - Clusters
Working with media - Slack Space
Forensic Imaging and their Formats - The Advanced Forensic Format (AFF)
Forensic Imaging and their Formats - Encase Image (E01)
Forensic Imaging and their Formats - DD (raw)
http://cs.harvard.edu/malan/publications/aff.pdf
In this series
Working with media - Unallocated Space
Working with media - Allocated Space
Working with media - Partitioning
Working with media - Sectors
Working with media - Clusters
Working with media - Slack Space
Forensic Imaging and their Formats - The Advanced Forensic Format (AFF)
Forensic Imaging and their Formats - Encase Image (E01)
Forensic Imaging and their Formats - DD (raw)
No comments:
Post a Comment