Image File Acquisition

There are several image formats for acquired data:

  • raw image – the most flexible format, supported by all analysis software.

  • raw image + external metadata – like the raw image, but adds another file with description data, hash values, and time.

  • embedded image – proprietary format, the metadata is embedded inside the image.

  • some image file formats support compression:

    • save storage space, but the acquisition process takes longer to complete.

    • not all tools support compressed image files – it might be required to uncompress first.

    • a good solution for long-term storage of image files.

Acquisition

  • local acquisition – implies physical access to the storage drive.

  • remote acquisition:

    • when it is not possible to have physical access to the storage drive.

    • When there are no adequate adapters for the storage medium.

    • This process is slower, usage of compression is recommended.

    • If there is no full control of the network encryption should be used.

Last updated