Creating an image of a device allows the original to be preserved, thus protecting information from damage and specifically protecting it during analysis.
In this section, you will learn to explain what altered and unaltered disk images are, and how these can be used in evidence.
An image in which block by block copying is possible, sometimes referred to as a physical copy, image retains every block, regardless of whether they are free, unallocated space, or if they contain a file. As discussed in the previous chapter, mass storage devices rarely have truly blank space from the time they have left the factory. Virtual memory pages/swap files, previously deleted files, metadata, and auto recovery information all leave a trace among the free space. A physical copy may, therefore, yield information that a logical copy (a copy of all the files) might not...
