What is forensic imaging? A forensic image is an exact bit for bit copy of a hard drive or any other digital media mainly to be used as evidence. Forensic image copies, include, boot record, slack, and unallocated space. Your IT person can make a backup copy of a hard drive or digital media, but it is not an exact, defensible copy of that data.

Forensic images vary from backup copies, differing in their accuracy, completeness, and legal adequacy. Forensic images; (1) adhere to specific, vital procedures, including documenting chain-of-custody, (2) execute a bit for bit copy of all the sectors on the hard drive or digital media, (3) permit for subsequent recovery of deleted files and deleted email, (4) permit for subsequent data recovery from slack space, (5) data verification utilizing a particular accepted algorithm, (6) guaranteeing that the original and copy are exactly identical. Improper collection and preservation will put your data into scrutiny about being able to offer it into evidence.

Hiring an e-Discovery firm such as RELEVANT e DISCOVERY is critical if there is even a slight chance that electronically stored information may be deleted, as this may change the outcome of your case. It is with the help of an e-Discovery specialist that you will be able to preserve electronic data that may be used in your case. A simple computer backup of the data files will not secure needed information to prove whether data was deleted.

Forensic image preservation is the most common court accepted process used to resolve your data’s authenticity. Only preservation of electronically stored information from computers, smartphones, tablets, and servers will allow the examination of deleted information in a legally defensible manner.