Image File Acquisition
There are several image formats for acquired data:
raw image – the most flexible format, supported by all analysis software.
raw image + external metadata – like the raw image, but adds another file with description data, hash values, and time.
embedded image – proprietary format, the metadata is embedded inside the image.
some image file formats support compression:
save storage space, but the acquisition process takes longer to complete.
not all tools support compressed image files – it might be required to uncompress first.
a good solution for long-term storage of image files.
Acquisition
local acquisition – implies physical access to the storage drive.
remote acquisition:
when it is not possible to have physical access to the storage drive.
When there are no adequate adapters for the storage medium.
This process is slower, usage of compression is recommended.
If there is no full control of the network encryption should be used.
Last updated