Internship
Student login
← Digital Forensics learning path
Digital Forensics · Module 5 of 10

Forensic acquisition and tools

Create forensic images with trusted tools.

📖 Key ideas

  1. A forensic image is a bit-by-bit copy of storage.
  2. Formats: raw (dd), E01 (EnCase).
  3. Tools: FTK Imager, Autopsy/The Sleuth Kit, EnCase, X-Ways.
  4. Verify images with hashes before and after.
  5. Document tool names, versions and settings.
💡 Real-life example: A forensic image is a perfect photocopy of every page, including blank and torn ones.
Forensic imageBit-by-bit copy of storage
E01EnCase evidence file format
AutopsyOpen-source forensic platform
FTK ImagerImaging tool