Data Collection & Drive Imaging
The process of collecting data and media imaging can be tricky. The most critical factor in this process is preservation of the source data in its pristine format. Any attempt at collecting data or media imaging that is not done following proper preservation steps and with the necessary equipment, can both disrupt the original data and not create an exact image of the original media.
We have the ability to perform either on-site or in-lab, forensic data collection and media imaging services. Our collection and media imaging services are performed using with sound forensic methods and industry accepted practices. This includes utilizing only industry accepted hardware and software for all collection and imaging process.
The collection / imaging process involves all the necessary write-blocking devices and duplication equipment needed to create what is known as a bit-stream image of your media. A bit-stream copy is an exact “bit-for-bit” copy of your original media. This includes not only normal files, but files that reside in the area know as unallocated space where many deleted files and file fragments can exist. Furthermore, we can create images in various formats including:
- DD (Raw)
- E01 (EnCase)
- AD1 (AccessData)
- Single Capture
Plus various others.
All images created are verified with the industry standard MD5, SHA1, and/or SHA256 hashes to assure you that you have an exact copy of the source media.