Forensic imaging is the process used to make a complete copy of all accessible data (such as documents, pictures and E-Mail messages) stored upon an electronic storage device (such as a computer's internal disk drive, a portable USB memory stick or a mobile phone).
How long does it take ?
The imaging process is dependant on the capacity (size in Gigabytes) of the storage medium - small computer disk drives can be imaged in around 1-2 hours, regular sized disks taking around 2-4 hours and very large taking anything from 6 to 12+ hours.
Planning the process is important to ensure their is sufficient time to ensure the copy can be completed within the available timeframe.
Are forensic images really needed ? Can't we just copy the files off the computer and save money ?
Forensic images are usually the source of evidence in most cases, so it is critical they are collected in the correct manner.
Failure to do this can cause a law-suit or other legal matter to be thrown out of court on the grounds that the integrity of the Email/Documents presented to the court cannot be verified to a forensic standard.
How is it done ?
There are a number of ways in which an image of a piece of electronic media can be captured, usually this involves removing the hard drive from a computer/laptop and connecting it to a court approved device, known as a 'write blocker' that prevents the original computer's hard drive from being written to and thus modified.
Any form of modification to the computer's original hard disk drive can be interpreted by the court as tampering, hence the need for forensic imaging.
The 'imaging' process (which can take place in our laboratory or on-site at any given location) is carried out using industry standard computer equipment that has been developed specifically for the purpose of preserving digital evidence.
Contact Us now, to discuss your imaging requirements - we would be happy to provide you with a no obligation quotation.