The American Society of

            Digital Forensics & eDiscovery, Inc

            For Digital Evidence Experts™

Computer Forensics Image

A computer forensics image is created to preserve data. This data can reside on a variety of media, such as a hard drive, a thumb drive, a network share, or many others. The tools and techniques used depend on the specific type of media and the circumstances of the collection. 

A computer forensics image has two hallmark traits. The first trait is the preservation of data integrity. This means that to the extent technically possible, the data is protected from alteration. The second trait is completeness. This means that it captures all of the data, which includes the logical data and less obvious information such as the ‘file slack’ (see below) and the metadata.

A computer forensics image is a true and accurate copy of the data. It is unaltered, to the greatest extent possible. This image represents all of the targeted data. It is often referred to as a bit-by-bit image. This means that every single bit of data is contained within it. 

Computer users are familiar with making a copy of data. This data is generally understood to be the logical data. This information is copied or moved with the standard Windows ‘Copy’ command.  

When data is copied to a new location, it is possible that old data resided within that same location. If the older data was larger than the new data, certain pieces of the old data might remain on the media even after the new data has partly overwritten it. This remaining older data can be very revealing to an investigator, and it is called a ‘file slack.’

Computer users are often shocked to discover that on most operating systems, the name of a file is not stored within the file itself. Changing the file name generally doesn’t alter any of the data within the file. For example, on Windows 10, the file name is stored within a special system file called $MFT, which stands for Master File Table. This table is full of a file’s metadata. File metadata includes the file name, file created date, file modified date, file size, and many other items.

In many cases when a computer forensic image is created, a mathematical formula is used to create a digital fingerprint of the data and parts of the data. This is called a hash value. Examples include the MD5 hash, which is message digest #5, or the secure hashing algorithm (SHA). This value facilitates a quick and easy verification process in the future.

Digital Evidence Digest - Sign Up Today!

* required





Email & Social Media Marketing by

There are several computer programs, offered by a variety of software manufacturers, which will create a computer forensics image. For example:

  • Open Text’s software, called Encase.
  • Access Data’s software, called FTK Imager.
  • Linux command, called DD.

Encase Forensically is perhaps one of the most widely known data forensics programs within the community. Encase creates a computer forensic image into a specific data format, which is called Expert Witness. This format has error checking and the first file’s extension will be E01. If the image exceeds a specified size, a second file is created with the file extension of E02, and so on. 

FTK Imager was created by Access Data and is widely used within the forensic community. It will create a computer forensic image in the Expert Witness format.

DD is common on Linux, Apple, and Unix systems. While this file does contain all of the data, it does not have any inherent error checking.

While there are a variety of formats and ways to create a computer forensics image, the image must have integrity and be complete.  The Expert Witness and DD formats do both; however, Expert Witness also contains a series of built-in checks to allow for ease of verification.

If you would like more information about computer forensics images, please refer to other articles on the American Society of Digital Forensics and eDiscovery’s website at


The American Society of

     Digital Forensics & eDiscovery, Inc™

     For Digital Evidence Experts™

       2451 Cumberland Parkway, Suite 3382 

       Atlanta, GA 30339-6157

       (866) 534-9734



Copyright 2021

All Rights Reserved

Powered by Wild Apricot Membership Software