Understanding Forensic Images Mark Pollitt Associate Professor

Files Have Three Parts Meta Data File Data Allocated Space Slack DataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataData Slack This is an old file that was overwritten by the data file above, but you can still read the end of it. This is what is known as file slack. Meta Data File Data

File Copy Meta Data Changes File Data Stays the Same Slack Is NOT Copied File Copy only takes the file data and modifies the meta data, leaving the slack behind.

Forensic Copy - Bit Image Drive 1 2 3 4 5 6 7 Forensic Image File DataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataData Slack This is an old file that was overwritten by the data file above, but you can still read the end of it. This is what is known as file slack. In a forensic copy, we copy every bit (data and slack) of every sector, including the metadata areas. Thus, we have a compete duplicate of the drive contents.