Image File Acquisition

There are several image formats for acquired data:

• raw image – the most flexible format, supported by all analysis software.

• raw image + external metadata – like the raw image, but adds another file with description data, hash values, and time.

• embedded image – proprietary format, the metadata is embedded inside the image.

• some image file formats support compression:

  • save storage space, but the acquisition process takes longer to complete.

  • not all tools support compressed image files – it might be required to uncompress first.

  • a good solution for long-term storage of image files.

Acquisition

• local acquisition – implies physical access to the storage drive.

• remote acquisition:

  • when it is not possible to have physical access to the storage drive.

  • When there are no adequate adapters for the storage medium.

  • This process is slower, usage of compression is recommended.

  • If there is no full control of the network encryption should be used.