1. Understanding Forensic Images
Mark Pollitt
Associate Professor

2. Files Have Three Parts Meta Data File Data Allocated Space Slack
DataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataData
Slack
This is an old file that was overwritten by the data file above, but you can still read the end of it. This is what is known as file slack.
Meta Data
File Data

3. File Copy Meta Data Changes File Data Stays the Same Slack
Is NOT Copied
File Copy only takes the file data and modifies the meta data, leaving the slack behind.

4. Forensic Copy - Bit Image
Drive 1 2 3 4 5 6 7
Forensic Image File
DataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataDataData
Slack
This is an old file that was overwritten by the data file above, but you can still read the end of it. This is what is known as file slack.
In a forensic copy, we copy every bit (data and slack) of every sector, including the metadata areas. Thus, we have a compete duplicate of the drive contents.