A forensic image is a complete, bit-for-bit copy of a storage device, including the space the file system reports as empty. It is not a backup and not a file copy: it captures deleted data, slack space and unallocated areas, and it is verified with a cryptographic hash so the copy can be proven identical to the source.
What "bit-for-bit" actually buys you
When you copy files, you get the files the operating system agrees to show you. When you image a device, you get the device — every sector, in order, whether or not anything currently claims to be using it.
That difference is where most of the evidentiary value lives. Deleting a file usually removes the pointer to it, not the content, so the content stays until something overwrites it. Files also rarely fill their last allocated block, and the leftover — slack space — can hold fragments of whatever was there before. None of that survives a file copy, and none of it is present in an ordinary backup.
Logical images, and when they are the right answer
A logical image captures a defined subset — a mailbox, a user profile, a set of folders — rather than the whole device. It is not a lesser technique; it is a different one, and choosing between them is a real decision rather than a matter of thoroughness.
Physical imaging is right when deleted data may matter, when the question is what someone did rather than what they kept, or when the device itself is the subject of the dispute. Logical imaging is right when the scope is genuinely narrower — a cloud mailbox with no underlying device you can seize, a custodian's work folders on a shared server, a proportionality order that says so. Imaging an entire 4TB array to answer a question about twelve documents is not diligence, and a court may say so when the bill arrives.
Verification is the part that matters in court
A forensic imaging tool computes a hash of the source as it reads, computes a hash of the image it wrote, and reports whether the two agree. That verification is what converts "I copied it carefully" into a testable claim: anyone can re-hash the image and compare.
Re-verification before analysis matters as much as verification at acquisition, because it is what closes the gap between the two events. An examiner who hashes the working copy before beginning, and again at the end, can say precisely what they analysed and that they did not alter it.
Practical constraints worth knowing before you ask for one
- Encryption changes the plan. A powered-down device with full-disk encryption images fine and decrypts to nothing without the key. Where possible, acquisition happens while the device is running and the volume is unlocked, which is a different and more urgent procedure.
- Solid-state drives can destroy evidence on their own. Wear-levelling and garbage collection may erase deleted content without anyone touching the device. Time matters more with SSDs than with spinning disks.
- Phones are not small computers. Mobile acquisition depends heavily on the model, the OS version, and the security state, and the achievable extraction can range from a full physical image to a logical extract of whatever the vendor's API exposes.
- Size drives cost and time. Imaging is largely bounded by read speed. A large array is a multi-day acquisition before anyone has looked at anything.
The instruction to give
If you take one thing from this: do not let anyone "grab a copy" first. The most common way evidence is damaged is a well-intentioned IT administrator making a backup before the forensic examiner arrives. That single step can change timestamps across the file system and it cannot be undone.
From our work
Dealing with forensic image in a live matter?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.