What is forensic imaging?

Forensic imaging, also called data imaging or forensic acquisition, is the first technical step in most digital forensics work. Instead of examining an original laptop, phone or server directly, an examiner creates a complete copy of it and works only on that copy.

The defining feature is that the image is exact. It reproduces every bit of the source, including deleted material, unallocated space and system files, and its accuracy is proved mathematically through a hash value.

How does forensic imaging work?

A typical acquisition follows a disciplined sequence:

1. Identify and document the source. Record make, model, serial number, storage capacity, condition and who handed it over.
2. Protect the original. Use a hardware or software write-blocker so nothing is written to the source during acquisition.
3. Acquire. Create a bit-stream (physical) image, or a logical image where a full physical copy is not possible, as with many mobile phones and cloud accounts.
4. Hash and verify. Compute a hash of the source and of the image, commonly SHA-256, and confirm they match.
5. Record the chain of custody. Log every transfer and storage location of the original and the image.
6. Work on a copy. Analysis is carried out on a working copy, so the master image stays untouched.

NIST SP 800-86 describes digital forensics as moving through collection, examination, analysis and reporting. Imaging sits at the collection stage, and errors made here are hard to repair later.

Physical, logical and targeted images

• Physical image: a sector-by-sector copy of the entire storage medium. It is the most complete, and it can recover deleted data.
• Logical image: a copy of the active file system or selected folders. It is quicker, but it does not capture deleted data in unallocated space.
• Targeted or remote collection: used for mailboxes, cloud storage and collaboration platforms, where physical access is not possible. It is common in eDiscovery.

The right choice depends on the allegation, the data source and proportionality.

Why does forensic imaging matter in India?

Under s. 63 of the Bharatiya Sakshya Adhiniyam 2023, electronic records submitted in evidence must be accompanied by a certificate in the form set out in the Schedule. Both Part A (the party) and Part B (the expert) record hash values of the record. A properly hashed forensic image makes a Section 63 certificate straightforward to support, because the expert can show exactly what was collected and that it has not changed.

The Bharatiya Nagarik Suraksha Sanhita 2023 also reflects the shift towards documented evidence handling. For example, s. 105 requires police searches and seizures to be recorded by audio-video electronic means.

When is forensic imaging used?

• Internal investigations into fraud, data theft or misconduct, before an employee exits or devices are reissued.
• Responding to a business email compromise or other cyber incident.
• Preserving evidence before litigation, arbitration or a police complaint.
• Insolvency matters, where a resolution professional needs to secure company systems.
• Regulatory inquiries where records may be requested later.

Red flags that evidence was not properly imaged

• IT staff "had a look" at the device before preservation.
• Files were forwarded or exported with no hash values recorded.
• No write-blocking or acquisition log exists.
• The original device was reformatted or reissued.
• Only MD5 or SHA-1 hashes were used, with no stronger algorithm alongside. NIST has announced a phase-out of SHA-1 by 31 December 2030, so SHA-256 is the safer default.

How does it differ from backup or chain of custody?

A backup is designed to restore working data and routinely skips deleted material and metadata. Forensic imaging is designed to preserve evidence. Chain of custody is the separate record proving who handled the original and the image, and when.

For the practical steps of preserving evidence during an internal inquiry, see our guide on preserving digital evidence in internal investigations. Our digital forensics and eDiscovery service covers device and cloud acquisition, hashing and documentation.