CyberGuard dictionary / Incident Response
Forensic Imaging
Forensic imaging is the controlled copying of a storage device or data source for analysis while retaining an identifiable original and documenting integrity.
In simple terms
Investigators analyze a copy so they can avoid unnecessary changes to the original device or media.
Technical explanation
A bit-stream image may capture allocated and unallocated sectors. The operator records tool and device details, collection steps, errors, and hashes; some live systems require other acquisition methods and cannot be treated as an unchanged disk snapshot.
Imaging creates a reviewable copy while documenting collection conditions and integrity. Live acquisition can change a running system, so the method and its limits must be recorded.
Examples in practice
A responder creates a verified image of a seized laptop drive, stores the original securely, and examines the copy.
The team images a powered-off laptop drive through a write blocker and verifies the copy. For a live cloud instance, it uses a different snapshot process and records that distinction.
Why it matters
A documented image lets analysts repeat analysis and compare findings against the collected source.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.