Data Forensics

DSE3241

[Link] Joshi
Email Id: [Link]@[Link]

Department of Data Science and Engineering, SCSE

Manipal University Jaipur

[Link] Joshi (WS-50 (AB2,FB3)) DF 1 / 75

 Course Outcome, Syllabus and Books

Table of Content

1 Course Outcome, Syllabus and Books

2 Module 1

3 Module 2

[Link] Joshi (WS-50 (AB2,FB3)) DF 2 / 75

 Module 1

Table of Content

1 Course Outcome, Syllabus and Books

2 Module 1

3 Module 2

[Link] Joshi (WS-50 (AB2,FB3)) DF 3 / 75

 Module 2

Table of Content

1 Course Outcome, Syllabus and Books

2 Module 1

3 Module 2

[Link] Joshi (WS-50 (AB2,FB3)) DF 4 / 75

 Module 2

Data Acquisition and Preservation

Key Focus:
Collection of digital evidence
Protection against alteration
Legal admissibility

Data acquisition and preservation represent the most critical phase of a

digital forensic investigation. This phase involves collecting digital
evidence in a scientifically sound manner while ensuring that the
original data remains unchanged throughout the investigation. Unlike
physical evidence, digital evidence is extremely fragile and can be
modified unintentionally by normal system operations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 5 / 75

 Module 2

Data Acquisition and Preservation

Preservation ensures that once evidence is collected, it is protected

from unauthorized access, accidental modification, or intentional
tampering. If acquisition or preservation is performed incorrectly, even
the most advanced forensic analysis becomes legally meaningless, as
courts place strong emphasis on how evidence was handled.

[Link] Joshi (WS-50 (AB2,FB3)) DF 6 / 75

 Module 2

Why Data Acquisition Comes Before Analysis

Key Focus:
Order of forensic process
Court expectations
Risk of contamination

In digital forensics, analysis does not begin until data acquisition is

completed correctly. Courts and forensic standards require
investigators to first prove that the evidence was collected without
alteration before any conclusions drawn from it can be considered
valid. Improper acquisition can introduce doubts regarding evidence
authenticity.
Digital systems continuously update metadata such as access times,
logs, and caches. Therefore, even a minor mistake during acquisition
can permanently alter evidence. This is why acquisition is treated as
the foundation upon which the entire forensic investigation is built.
[Link] Joshi (WS-50 (AB2,FB3)) DF 7 / 75
 Module 2

Preservation of Digital Evidence

Key Focus:
Evidence protection
Integrity maintenance
Controlled access

Preservation refers to the set of actions taken to maintain the integrity

of digital evidence after it has been identified and collected. This
includes securing storage devices, restricting access, maintaining
environmental controls, and ensuring proper documentation.
Preservation ensures that evidence remains in the same condition as it
was at the time of seizure.
Failure to preserve evidence correctly can lead to data corruption, loss,
or allegations of tampering. Proper preservation practices protect both
the evidence and the investigator by maintaining a clear and defensible
forensic trail.
[Link] Joshi (WS-50 (AB2,FB3)) DF 8 / 75
 Module 2

Relationship Between Acquisition and Preservation

Key Focus:
Continuous process
Evidence lifecycle
Legal defensibility

Data acquisition and preservation are not separate or isolated steps but
part of a continuous forensic process. Acquisition focuses on collecting
evidence, while preservation ensures that the collected evidence
remains unchanged throughout its lifecycle. Both must be executed
together to maintain forensic soundness.
If acquisition is correct but preservation is weak, evidence may still be
rejected in court. Therefore, investigators must treat acquisition and
preservation as equally important components of the forensic workflow.

[Link] Joshi (WS-50 (AB2,FB3)) DF 9 / 75

 Module 2

Real-World Story: Evidence Lost Before Analysis

In a cybercrime investigation, a suspect’s laptop was seized and stored

in an unsecured office for several days before forensic imaging was
performed. During this time, multiple personnel accessed the device
without documentation. When forensic analysis began, metadata
inconsistencies were detected.
During the trial, the defense argued that evidence integrity could not
be guaranteed due to poor preservation practices. As a result, critical
digital evidence was rejected by the court, even though the analysis
itself was technically sound. This case demonstrates that failures in
acquisition and preservation can destroy a case before analysis even
begins.

[Link] Joshi (WS-50 (AB2,FB3)) DF 10 / 75

 Module 2

Forensic Duplication
Key Focus:
Exact copying of digital evidence
Protection of original data
Foundation for legal analysis

Forensic duplication is the process of creating an exact, bit-by-bit copy

of digital evidence so that forensic examination can be performed
without altering the original data source. In digital forensics,
investigators are not permitted to directly analyze original evidence
because even routine system operations can unintentionally modify
data.
By creating a forensic duplicate, investigators ensure that the original
evidence remains preserved in its seized condition, while the duplicate
copy is used for all analysis, testing, and verification activities. This
practice is universally accepted as a core forensic principle.
[Link] Joshi (WS-50 (AB2,FB3)) DF 11 / 75
 Module 2

Why Forensic Duplication Is Mandatory

Key Focus:
Fragile nature of digital data
Court expectations
Repeatability of analysis

Digital evidence is extremely fragile because operating systems

automatically update metadata such as access times, logs, and system
files. Even viewing a file or mounting a disk can introduce changes that
compromise evidence integrity.
Forensic duplication eliminates this risk by isolating the original
evidence from investigative activities. Courts expect investigators to
demonstrate that analysis was conducted on verified copies, ensuring
that findings can be reproduced and independently validated if
required.

[Link] Joshi (WS-50 (AB2,FB3)) DF 12 / 75

 Module 2

Forensic Duplication vs Normal Copying

Key Focus:
Scope of copied data
Reliability
Forensic acceptance

Normal file copying copies only visible and accessible files from a
storage device. It ignores deleted files, unallocated space, and slack
space, which may contain critical forensic evidence. Such copying
methods are unsuitable for forensic investigations.
In contrast, forensic duplication captures every bit of data present on
the storage medium, including hidden and deleted information. This
comprehensive approach enables investigators to recover evidence that
suspects may have attempted to destroy or conceal.

[Link] Joshi (WS-50 (AB2,FB3)) DF 13 / 75

 Module 2

Objectives of Forensic Duplication

Key Focus:
Evidence preservation
Legal defensibility
Safe analysis

The primary objective of forensic duplication is to preserve the

integrity of original evidence while allowing thorough forensic analysis.
Duplication ensures that original devices remain untouched and can be
re-examined if required by the court or defense experts.
Additionally, forensic duplication supports safe experimentation,
repeated analysis, and the use of multiple tools without risking
contamination of the original data source.

[Link] Joshi (WS-50 (AB2,FB3)) DF 14 / 75

 Module 2

When Forensic Duplication Is Performed

Key Focus:
Early investigation stage
Before analysis
After preservation

Forensic duplication is typically performed immediately after evidence

identification and preservation. It marks the transition from evidence
handling to forensic analysis.
Delaying duplication increases the risk of accidental modification, loss,
or unauthorized access. Therefore, timely forensic duplication is
considered a best practice in digital investigations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 15 / 75

 Module 2

Real-World Story: Duplication Protects the Investigator

In an intellectual property theft case, investigators suspected that

confidential source code had been copied and deleted from a developer’s
laptop. A forensic image of the hard disk was created immediately
after seizure, and the original laptop was sealed and stored securely.
During trial, the defense claimed that the evidence was fabricated.
Investigators produced matching hash values and detailed duplication
records, proving that analysis was conducted only on verified copies.
The court accepted the evidence, demonstrating that forensic
duplication not only protects evidence but also protects investigators
from legal allegations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 16 / 75

 Module 2

Consequences of Skipping Forensic Duplication

Key Focus:
Evidence contamination
Legal challenges
Case failure

Skipping forensic duplication and directly analyzing original evidence

can lead to unintended data modification. Such changes may be subtle
but are sufficient to raise serious doubts during legal proceedings.
In many cases, courts have rejected digital evidence solely because
investigators failed to demonstrate that proper duplication procedures
were followed. This highlights that forensic duplication is not optional
but a mandatory requirement for credible digital investigations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 17 / 75

 Module 2

Imaging and Cloning

Key Focus:
Methods of forensic duplication
Disk image vs physical copy
Forensic preference

Imaging and cloning are two commonly used techniques for duplicating
digital storage devices during forensic investigations. Both methods
involve copying data from an original device; however, their purpose,
implementation, and forensic suitability differ significantly.
Understanding this distinction is essential because the choice of
duplication method can directly impact evidence integrity and legal
admissibility.
In forensic practice, imaging is generally preferred over cloning due to
its flexibility, verifiability, and compatibility with forensic tools and
legal requirements.
[Link] Joshi (WS-50 (AB2,FB3)) DF 18 / 75
 Module 2

Disk Imaging

Key Focus:
Forensic image file
Complete data capture
Analysis-ready format

Disk imaging is the process of creating a forensic image file that

represents the complete contents of a storage device. This image is a
bit-by-bit copy that includes all data present on the disk, such as
active files, deleted files, unallocated space, and slack space.
The primary purpose of disk imaging is to enable investigators to
analyze digital evidence in a controlled environment without
interacting with the original device. Forensic images can be stored,
duplicated, verified, and reanalyzed multiple times, making them ideal
for legal investigations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 19 / 75

 Module 2

Characteristics of Disk Imaging

Key Focus:
Bit-level accuracy
Hash verification
Portability

A key characteristic of disk imaging is its accuracy at the bit level.

Every bit of data is copied exactly as it exists on the source device.
This allows forensic tools to recover deleted or hidden data that would
otherwise be inaccessible through normal file-copy operations.
Disk images are verified using cryptographic hash values, which
confirm that the image is an exact replica of the original device.
Because of this verifiability and portability, disk images are widely
accepted by courts and forensic laboratories.

[Link] Joshi (WS-50 (AB2,FB3)) DF 20 / 75

 Module 2

Disk Cloning

Key Focus:
Physical disk-to-disk copy
Hardware replacement
Limited forensic use

Disk cloning involves creating a physical replica of a storage device by

copying data directly from one disk to another disk. The result is a
second disk that mirrors the original device in structure and content.
Cloning is commonly used for system recovery, backup, or hardware
replacement. However, in forensic investigations, cloning is less
preferred because managing physical copies introduces handling risks
and complicates verification and chain of custody documentation.

[Link] Joshi (WS-50 (AB2,FB3)) DF 21 / 75

 Module 2

Imaging vs Cloning

Key Focus:
Storage format
Verification capability
Forensic acceptance

The fundamental difference between imaging and cloning lies in how

the duplicated data is stored and verified. Imaging produces a forensic
image file that can be hashed, archived, and analyzed using specialized
tools. Cloning produces a second physical disk that is harder to
manage and verify.
Because forensic images support integrity verification and controlled
analysis, imaging is considered the standard duplication method in
digital forensics, while cloning is used only in limited scenarios.

[Link] Joshi (WS-50 (AB2,FB3)) DF 22 / 75

 Module 2

Why Imaging Is Preferred in Digital Forensics

Key Focus:
Legal defensibility
Evidence management
Repeatable analysis

Forensic imaging is preferred because it provides strong legal

defensibility. Investigators can demonstrate that the image has not
been altered by presenting matching hash values. Additionally, forensic
images are easier to store securely, duplicate safely, and share with
authorized experts.
Imaging also allows multiple analyses to be performed using different
tools without risking contamination of the original evidence. This
repeatability is a critical requirement in forensic science and legal
proceedings.

[Link] Joshi (WS-50 (AB2,FB3)) DF 23 / 75

 Module 2

Real-World Story: Imaging vs Cloning Decision

In a corporate fraud investigation, investigators initially considered

cloning the suspect’s hard disk to another drive. However, they chose
forensic imaging instead, creating a verified image file with recorded
hash values.
During the trial, the defense requested independent analysis. Because a
forensic image was available, the same image was provided to a
third-party expert, and hash values matched across all analyses. The
court accepted the evidence without dispute, demonstrating how
imaging simplifies verification and strengthens legal credibility.

[Link] Joshi (WS-50 (AB2,FB3)) DF 24 / 75

 Module 2

Consequences of Using Cloning Improperly

Key Focus:
Handling risks
Verification challenges
Legal complications

Improper use of disk cloning in forensic investigations can introduce

significant risks. Physical cloned disks are more susceptible to handling
errors, accidental modification, and chain of custody issues.
Additionally, without proper hashing and documentation, it becomes
difficult to prove that the cloned disk is an exact replica of the original.
Such weaknesses can be exploited during cross-examination, potentially
leading to evidence rejection. This reinforces why imaging, rather than
cloning, is the preferred forensic practice.

[Link] Joshi (WS-50 (AB2,FB3)) DF 25 / 75

 Module 2

Imaging and Cloning: Summary

Key Focus:
Imaging as forensic standard
Cloning as secondary option
Evidence integrity

Imaging and cloning are both data duplication techniques, but their
forensic value differs significantly. Disk imaging is the standard method
used in digital forensics due to its accuracy, verifiability, and legal
acceptance. Cloning is mainly used for operational purposes and
should be applied cautiously in forensic contexts.
Understanding when and why to use imaging versus cloning reflects
professional judgment and is essential for conducting reliable digital
forensic investigations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 26 / 75

 Module 2

Write Blockers

Key Focus:
Prevent modification of evidence
Read-only access
Mandatory forensic safeguard

A write blocker is a forensic control mechanism that prevents any write

operation to the original digital evidence during acquisition or
examination. Its primary purpose is to ensure that the storage device
being analyzed remains unchanged throughout the forensic process.
In digital forensics, even unintentional modifications—such as
automatic operating system updates—can compromise evidence
integrity. Write blockers act as a protective barrier between the
evidence device and the forensic workstation, ensuring that only read
operations are permitted.

[Link] Joshi (WS-50 (AB2,FB3)) DF 27 / 75

 Module 2

Why Write Blockers Are Essential

Key Focus:
Automatic OS writes
Metadata protection
Court expectations

Modern operating systems continuously perform background write

operations, such as updating access timestamps, system logs, and
indexing files. These changes can occur even when a user intends only
to view data.
Write blockers prevent such automatic writes and preserve the original
state of digital evidence. Courts and forensic standards strongly expect
investigators to use write blockers, as failure to do so can raise serious
doubts regarding evidence authenticity.

[Link] Joshi (WS-50 (AB2,FB3)) DF 28 / 75

 Module 2

Types of Write Blockers

Key Focus:
Hardware write blockers
Software write blockers
Reliability considerations

Write blockers are broadly classified into hardware and software write
blockers. Hardware write blockers are physical devices placed between
the evidence storage medium and the forensic system. They are highly
reliable and widely accepted in legal proceedings.
Software write blockers operate at the operating system level and are
generally used when hardware write blockers are unavailable. However,
they are considered less reliable because they depend on the integrity
of the operating system itself.

[Link] Joshi (WS-50 (AB2,FB3)) DF 29 / 75

 Module 2

Hardware vs Software Write Blockers

Key Focus:
Court acceptance
Risk of failure
Usage scenarios

Hardware write blockers are preferred in forensic investigations because

they operate independently of the operating system and provide strong
protection against accidental writes. They are commonly used by law
enforcement agencies and forensic laboratories.
Software write blockers may be useful in controlled environments or
live investigations, but they carry a higher risk of failure. Investigators
must justify their use and document procedures carefully when
hardware write blockers are not used.

[Link] Joshi (WS-50 (AB2,FB3)) DF 30 / 75

 Module 2

Data Integrity

Key Focus:
Evidence authenticity
No alteration guarantee
Continuous verification

Data integrity refers to the assurance that digital evidence remains

complete, consistent, and unaltered from the moment it is acquired
until it is presented in court. Maintaining integrity is a fundamental
requirement of digital forensic investigations.
Integrity is not a one-time activity but a continuous process involving
controlled acquisition, secure storage, limited access, and repeated
verification. Any compromise in integrity can undermine the credibility
of forensic findings.

[Link] Joshi (WS-50 (AB2,FB3)) DF 31 / 75

 Module 2

Role of Hashing in Data Integrity

Key Focus:
Digital fingerprint
Integrity verification
Mathematical proof

Hash functions generate a fixed-length value that uniquely represents

the contents of digital data. In digital forensics, hash values act as
digital fingerprints that help verify evidence integrity.
If even a single bit of data changes, the resulting hash value changes
completely. By comparing hash values before and after acquisition,
investigators can mathematically prove that the evidence has not been
altered.

[Link] Joshi (WS-50 (AB2,FB3)) DF 32 / 75

 Module 2

Common Hash Algorithms in Forensics

Key Focus:
MD5
SHA-1
SHA-256

Several cryptographic hash algorithms are used in digital forensics to

verify data integrity. MD5 and SHA-1 were widely used in earlier
investigations, while SHA-256 is increasingly preferred due to stronger
security properties.
Although some older algorithms have known vulnerabilities, they are
still accepted in many forensic contexts when used appropriately and
documented clearly.

[Link] Joshi (WS-50 (AB2,FB3)) DF 33 / 75

 Module 2

Real-World Story: No Write Blocker, No Evidence

In a cybercrime investigation, an investigator connected a suspect’s

hard disk directly to a forensic workstation without using a write
blocker. The operating system automatically updated file system
metadata during the connection.
During trial, the defense demonstrated that access timestamps had
changed after seizure. As a result, the court ruled that evidence
integrity could not be guaranteed and rejected the digital evidence.
This case clearly illustrates that failure to use write blockers can
destroy an otherwise strong forensic case.

[Link] Joshi (WS-50 (AB2,FB3)) DF 34 / 75

 Module 2

Real-World Story: Integrity Preserved Successfully

In a financial fraud investigation, investigators used a hardware write

blocker and recorded hash values at every stage of acquisition and
analysis. The original evidence was sealed and stored securely, while
analysis was conducted only on verified copies.
When the defense requested independent verification, hash values
matched exactly. The court accepted the evidence without dispute,
demonstrating that proper use of write blockers and integrity
verification strengthens legal credibility.

[Link] Joshi (WS-50 (AB2,FB3)) DF 35 / 75

 Module 2

Write Blockers and Data Integrity: Summary

Key Focus:
Write blockers prevent contamination
Hashing ensures integrity
Procedure outweighs tools

Write blockers and data integrity mechanisms together ensure that

digital evidence remains reliable and legally defensible. While forensic
tools are important, procedural discipline and proper documentation
play an even more critical role in maintaining evidence credibility.
This topic reinforces that digital forensics is governed by strict
methodology, where even small procedural mistakes can have major
legal consequences.

[Link] Joshi (WS-50 (AB2,FB3)) DF 36 / 75

 Module 2

Live vs Static Data Acquisition

Key Focus:
System state during acquisition
Volatile vs non-volatile data
Forensic risk assessment

Live and static data acquisition represent two fundamentally different

approaches to collecting digital evidence. The primary difference lies in
whether the system is powered on or powered off during the acquisition
process. Each approach has its own advantages, risks, and forensic
implications.
Choosing between live and static acquisition requires careful evaluation
of the situation, as an incorrect decision may result in permanent loss
of critical evidence or raise legal challenges regarding evidence integrity.

[Link] Joshi (WS-50 (AB2,FB3)) DF 37 / 75

 Module 2

Static Data Acquisition

Key Focus:
System powered off
Non-volatile data
Court-preferred method

Static data acquisition is performed when the target system is powered

off. In this approach, storage devices such as hard disks or solid-state
drives are removed or accessed without booting the operating system.
This method minimizes the risk of data modification during acquisition.
Because static acquisition avoids interaction with a running operating
system, it is considered the safest and most legally accepted method for
collecting digital evidence, especially when volatile data is not required.

[Link] Joshi (WS-50 (AB2,FB3)) DF 38 / 75

 Module 2

Advantages of Static Data Acquisition

Key Focus:
Minimal evidence alteration
High legal acceptance
Simpler documentation

The primary advantage of static data acquisition is the preservation of

evidence integrity. Since the system is powered off, no background
processes, system services, or automatic updates can modify the data
during acquisition.
This method also simplifies forensic documentation and justification in
court, as investigators can clearly demonstrate that no system-level
activity occurred during evidence collection.

[Link] Joshi (WS-50 (AB2,FB3)) DF 39 / 75

 Module 2

Limitations of Static Data Acquisition

Key Focus:
Loss of volatile data
No runtime context
Limited for active attacks

A major limitation of static acquisition is the loss of volatile data such

as RAM contents, running processes, active network connections, and
encryption keys stored in memory. Once the system is powered off, this
information is permanently lost.
In cases involving malware execution, ransomware, or live network
intrusions, the absence of volatile data can significantly reduce the
effectiveness of the investigation.

[Link] Joshi (WS-50 (AB2,FB3)) DF 40 / 75

 Module 2

Live Data Acquisition

Key Focus:
System powered on
Volatile data capture
High procedural risk

Live data acquisition is performed while the system is still running.

This approach allows investigators to capture volatile data that would
otherwise be lost if the system were shut down, such as memory
contents, running processes, and active network sessions.
Live acquisition is typically used in time-sensitive scenarios or when
volatile data plays a critical role in reconstructing the incident.
However, it introduces significant forensic and legal risks.

[Link] Joshi (WS-50 (AB2,FB3)) DF 41 / 75

 Module 2

Risks Associated with Live Data Acquisition

Key Focus:
System state alteration
Evidence contamination
Legal justification required

Executing commands or forensic tools on a live system inevitably alters

its state. Memory contents change continuously, and running
acquisition tools consume system resources, potentially modifying
evidence.
Due to these risks, investigators must carefully document each action
taken during live acquisition and provide strong justification for why
shutting down the system was not a viable option.

[Link] Joshi (WS-50 (AB2,FB3)) DF 42 / 75

 Module 2

Decision Criteria: Live vs Static

Key Focus:
Nature of incident
Importance of volatile data
Legal defensibility

The choice between live and static acquisition depends on several

factors, including the type of crime, system state, and nature of the
evidence required. Investigators must assess whether volatile data is
critical to the investigation and whether its loss would outweigh the
risks of live acquisition.
This decision reflects professional judgment and must be supported by
clear reasoning and thorough documentation.

[Link] Joshi (WS-50 (AB2,FB3)) DF 43 / 75

 Module 2

Real-World Story: Live Acquisition Success

In a ransomware investigation, investigators encountered an actively

infected server where encryption keys were stored in memory. Powering
off the system would have destroyed these keys permanently.
A carefully planned and documented live acquisition was performed to
capture memory data. The recovered keys enabled successful
decryption of files, proving that live acquisition, when justified and
executed correctly, can be crucial to solving complex cyber incidents.

[Link] Joshi (WS-50 (AB2,FB3)) DF 44 / 75

 Module 2

Real-World Story: Static Acquisition Failure

In another case, investigators shut down a compromised system

without considering the presence of volatile evidence. Important
runtime information related to malicious network activity was lost.
As a result, the investigation could not establish a complete attack
timeline. This case highlights that choosing static acquisition without
proper assessment can lead to irreversible evidence loss.

[Link] Joshi (WS-50 (AB2,FB3)) DF 45 / 75

 Module 2

Live vs Static Acquisition: Summary

Key Focus:
Static acquisition is safer and preferred
Live acquisition captures volatile evidence
Decision must be justified and documented

Live and static data acquisition techniques serve different investigative

purposes. While static acquisition offers greater safety and legal
acceptance, live acquisition becomes essential when volatile data is
critical to the case.
Understanding the strengths and limitations of both approaches is
essential for making informed forensic decisions and maintaining
evidence credibility.

[Link] Joshi (WS-50 (AB2,FB3)) DF 46 / 75

 Module 2

Bitstream Imaging Techniques

Key Focus:
Bit-by-bit copying
Complete data capture
Core forensic imaging method

Bitstream imaging is a forensic technique used to create an exact,

bit-by-bit copy of a digital storage device. Unlike logical copying,
which captures only active files and folders, bitstream imaging copies
every bit of data present on the device, regardless of whether it is
visible or accessible through the operating system.
This technique ensures that all potential evidence, including deleted
files and hidden data, is preserved. Because of its completeness and
reliability, bitstream imaging is considered the gold standard for
forensic duplication in digital investigations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 47 / 75

 Module 2

Data Captured in Bitstream Imaging

Key Focus:
Allocated space
Unallocated space
Slack space

Bitstream imaging captures all regions of a storage device, including

allocated space that contains active files, unallocated space that may
store remnants of deleted files, and slack space found between the end
of a file and the end of a disk cluster.
This comprehensive data capture enables forensic investigators to
recover evidence that suspects often believe has been permanently
destroyed, such as deleted documents, fragments of files, or remnants of
previous activity.

[Link] Joshi (WS-50 (AB2,FB3)) DF 48 / 75

 Module 2

Why Bitstream Imaging Is Critical

Key Focus:
Recovery of deleted data
Evidence completeness
Legal reliability

Many digital crimes involve attempts to hide or delete evidence.

Simple file deletion does not immediately remove data from storage;
instead, it marks the space as available for reuse. Bitstream imaging
preserves this data before it can be overwritten.
By capturing every bit of information, bitstream imaging provides
investigators with the opportunity to reconstruct user activity and
uncover concealed evidence. Courts widely accept bitstream images
because they represent the most complete and accurate snapshot of the
storage device.

[Link] Joshi (WS-50 (AB2,FB3)) DF 49 / 75

 Module 2

Bitstream Imaging vs Logical Imaging

Key Focus:
Scope of data captured
Forensic completeness
Use-case differences

Logical imaging copies only active files and directories that are
accessible through the file system. While faster, it fails to capture
deleted files, unallocated space, and slack space, making it unsuitable
for thorough forensic analysis.
Bitstream imaging, in contrast, captures the entire storage medium at
the lowest level. This makes it the preferred method when the
investigation requires complete evidence preservation and deeper
forensic examination.

[Link] Joshi (WS-50 (AB2,FB3)) DF 50 / 75

 Module 2

Bitstream Imaging Process

Key Focus:
Write blocker usage
Imaging tool execution
Hash verification

The bitstream imaging process begins by connecting the evidence

device to a forensic workstation using a write blocker to prevent
modification. A forensic imaging tool is then used to copy data
bit-by-bit from the source device to an image file or destination storage.
After imaging is completed, cryptographic hash values are calculated
for both the original device and the image. Matching hash values
confirm that the image is an exact and unaltered copy of the original
evidence.

[Link] Joshi (WS-50 (AB2,FB3)) DF 51 / 75

 Module 2

Storage Formats for Bitstream Images

Key Focus:
Raw image format
Proprietary formats
Compression considerations

Bitstream images can be stored in various formats. Raw formats store

data exactly as copied, while proprietary formats used by forensic tools
may include compression and metadata such as case details and hash
values.
Choosing an appropriate format depends on investigation
requirements, storage constraints, and tool compatibility. Regardless of
format, integrity verification remains mandatory.

[Link] Joshi (WS-50 (AB2,FB3)) DF 52 / 75

 Module 2

Limitations of Bitstream Imaging

Key Focus:
Time-consuming process
Large storage requirements
Hardware constraints

Bitstream imaging can be time-consuming, especially for large-capacity

storage devices. The resulting image files also require significant
storage space and secure handling.
Despite these challenges, the forensic value of bitstream imaging far
outweighs its limitations. Investigators must plan resources carefully to
ensure timely and secure acquisition.

[Link] Joshi (WS-50 (AB2,FB3)) DF 53 / 75

 Module 2

Real-World Story: Deleted Evidence Recovered

In a data theft investigation, a suspect claimed that all incriminating

files had been deleted permanently. Investigators created a bitstream
image of the hard disk before any further activity occurred.
During analysis, deleted documents were recovered from unallocated
space, revealing unauthorized data transfers. The court accepted the
evidence, demonstrating that bitstream imaging can recover evidence
that suspects believe is lost forever.

[Link] Joshi (WS-50 (AB2,FB3)) DF 54 / 75

 Module 2

Real-World Story: Imaging Performed Too Late

In another case, investigators delayed bitstream imaging while

conducting preliminary checks on the system. During this delay,
normal system operations overwrote unallocated space.
As a result, crucial deleted evidence was lost permanently. This case
highlights the importance of performing bitstream imaging as early as
possible in the forensic process.

[Link] Joshi (WS-50 (AB2,FB3)) DF 55 / 75

 Module 2

Bitstream Imaging: Summary

Key Focus:
Complete data preservation
Recovery of hidden evidence
Forensic best practice

Bitstream imaging is a cornerstone of digital forensic acquisition

techniques. By capturing every bit of data from a storage device, it
ensures comprehensive evidence preservation and supports reliable
forensic analysis.
Understanding when and how to apply bitstream imaging is essential
for conducting legally defensible digital investigations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 56 / 75

 Module 2

Data Acquisition Tools

Key Focus:
Forensic imaging utilities
Accuracy and integrity
Court-accepted tools

Data acquisition tools are specialized software and hardware utilities

used to collect digital evidence in a forensically sound manner. These
tools are designed to create exact copies of storage devices while
maintaining data integrity and preventing accidental modification.
The choice of acquisition tool plays a significant role in the reliability
and legal acceptance of digital evidence. Widely used forensic tools
include FTK Imager, the dd command-line utility, and commercial
forensic suites such as EnCase.

[Link] Joshi (WS-50 (AB2,FB3)) DF 57 / 75

 Module 2

FTK Imager

Key Focus:
User-friendly forensic tool
Disk and memory imaging
Hash verification

FTK Imager is a widely used forensic imaging tool developed to assist

investigators in acquiring digital evidence quickly and accurately. It
provides a graphical user interface that simplifies the imaging process,
making it suitable for both beginners and experienced forensic
practitioners.
FTK Imager supports disk imaging, file system preview, and integrity
verification through cryptographic hash values. Because of its ease of
use and reliability, it is commonly used in academic, corporate, and law
enforcement investigations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 58 / 75

 Module 2

FTK Imager – How It Works

Original Storage Device

Write Blocker

FTK Imager

Forensic Image File

Hash Verification

FTK Imager accesses the evidence in read-only mode, creates a forensic

image, and verifies integrity using hash values.

[Link] Joshi (WS-50 (AB2,FB3)) DF 59 / 75

 Module 2

FTK Imager – Forensic Significance

FTK Imager provides a controlled and legally accepted method for

acquiring digital evidence. Its graphical interface allows investigators
to preview files, capture disk images, and generate hash values without
modifying the original data.
Because FTK Imager automatically logs acquisition steps and integrity
checks, it is widely used in academic labs, corporate investigations, and
law enforcement environments.

[Link] Joshi (WS-50 (AB2,FB3)) DF 60 / 75

 Module 2

Why FTK Imager Is Popular

Key Focus:
Ease of use
Evidence verification
Reporting support

One of the main reasons for the popularity of FTK Imager is its ability
to perform forensic imaging while automatically generating hash values
for integrity verification. It also allows investigators to preview files
without modifying the original evidence.
FTK Imager generates clear logs and reports that help document the
acquisition process. This documentation is especially useful during
audits and legal proceedings, where investigators must explain how
evidence was collected.

[Link] Joshi (WS-50 (AB2,FB3)) DF 61 / 75

 Module 2

Real-World Story: FTK Imager in Practice

In a corporate insider-threat investigation, a suspect’s workstation was

seized for forensic examination. Investigators used FTK Imager to
create a verified disk image while maintaining a clear chain of custody.
During analysis, deleted files and unauthorized data transfers were
identified. Because the acquisition was performed using a recognized
forensic tool with proper documentation, the evidence was accepted
without challenge, highlighting the practical value of FTK Imager in
real investigations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 62 / 75

 Module 2

The dd Tool

Key Focus:
Command-line utility
Bit-level copying
Unix/Linux environments

The dd command is a low-level data copying utility commonly available

on Unix and Linux systems. It performs bit-by-bit copying of data
from a source device to a destination, making it suitable for forensic
imaging when used correctly.
Although dd is not specifically designed as a forensic tool, it is widely
used in forensic investigations due to its reliability, precision, and
ability to capture complete disk images.

[Link] Joshi (WS-50 (AB2,FB3)) DF 63 / 75

 Module 2

dd Command – Bitstream Imaging Workflow

Source Device (/dev/sda)

dd Utility

Image File / Destination Disk

Manual Hash Verification

dd performs a low-level, bit-by-bit copy without built-in safeguards.

[Link] Joshi (WS-50 (AB2,FB3)) DF 64 / 75

 Module 2

dd – Forensic Interpretation

The dd command copies data at the lowest level of the storage device,
making it suitable for forensic bitstream imaging. However, it does not
provide automatic logging, write protection, or hash verification.
This makes dd powerful but dangerous. In forensic practice, it must
always be used with extreme care, write blockers, and manual integrity
verification.

[Link] Joshi (WS-50 (AB2,FB3)) DF 65 / 75

 Module 2

Advantages and Risks of Using dd

Key Focus:
High accuracy
No built-in safeguards
Requires expertise

The primary advantage of the dd tool is its ability to copy data at the
lowest level, ensuring accurate bitstream images. However, it does not
provide built-in safeguards such as automatic hashing or write
protection.
Because of this, improper use of dd can result in irreversible data loss.
Investigators must therefore use dd with extreme caution and
complement it with proper write blockers and hash verification.

[Link] Joshi (WS-50 (AB2,FB3)) DF 66 / 75

 Module 2

Real-World Story: dd Used Incorrectly

In a forensic lab exercise, an inexperienced investigator mistakenly

reversed the input and output parameters while using the dd
command. This error resulted in overwriting the original evidence disk.
The incident rendered the evidence unusable and demonstrated that
while dd is powerful, it requires a strong understanding of forensic
procedures and command-line operations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 67 / 75

 Module 2

EnCase

Key Focus:
Commercial forensic suite
End-to-end investigation
Law enforcement standard

EnCase is a comprehensive commercial digital forensic platform widely

used by law enforcement agencies and forensic laboratories. It provides
tools for data acquisition, analysis, reporting, and case management
within a single environment.
Because of its extensive features and court acceptance, EnCase is often
used in high-profile and complex digital investigations.

[Link] Joshi (WS-50 (AB2,FB3)) DF 68 / 75

 Module 2

EnCase – End-to-End Forensic Workflow

Evidence Device

EnCase Acquisition

EnCase Evidence File

Analysis Engine

Court-Ready Report

EnCase integrates acquisition, analysis, and reporting into a single

forensic platform.

[Link] Joshi (WS-50 (AB2,FB3)) DF 69 / 75

 Module 2

EnCase – Why It Is Legally Strong

EnCase records every investigator action through detailed logs and

audit trails. Each step—from acquisition to reporting—is documented,
making the investigation transparent and legally defensible.
This is why EnCase is widely used by law enforcement agencies and
forensic laboratories for cases that are expected to face courtroom
scrutiny.

[Link] Joshi (WS-50 (AB2,FB3)) DF 70 / 75

 Module 2

Why EnCase Is Legally Strong

Key Focus:
Court acceptance
Strong documentation
Audit readiness

EnCase is considered legally strong because it provides comprehensive

documentation, logging, and reporting features. Every action
performed during acquisition and analysis is recorded, enabling
investigators to clearly explain their methodology in court.
Its widespread acceptance by law enforcement agencies further
strengthens its credibility, making it a preferred choice for
investigations that may involve legal scrutiny.

[Link] Joshi (WS-50 (AB2,FB3)) DF 71 / 75

 Module 2

Real-World Story: EnCase in Law Enforcement

In a cybercrime investigation involving financial fraud, law enforcement

officers used EnCase to acquire and analyze digital evidence from
multiple systems. The tool’s detailed logs and structured reports
helped investigators present findings clearly in court.
The defense raised procedural questions, but EnCase’s comprehensive
documentation allowed investigators to justify every step. The
evidence was accepted, demonstrating the value of using legally
recognized forensic tools.

[Link] Joshi (WS-50 (AB2,FB3)) DF 72 / 75

 Module 2

Comparison of Data Acquisition Tools

Key Focus:
Ease of use
Level of control
Legal acceptance

FTK Imager, dd, and EnCase serve different purposes in digital

forensics. FTK Imager offers ease of use and quick imaging, dd
provides low-level control with higher risk, and EnCase delivers a
comprehensive, legally robust forensic environment.
Selecting the appropriate tool depends on the investigator’s expertise,
case requirements, and legal context.

[Link] Joshi (WS-50 (AB2,FB3)) DF 73 / 75

 Module 2

Data Acquisition Tools: Summary

Key Focus:
Tools support forensic procedures
Correct usage is critical
Documentation ensures credibility

Data acquisition tools play a vital role in collecting digital evidence,

but tools alone do not guarantee forensic soundness. Proper
procedures, documentation, and professional judgment are equally
important.
This topic reinforces that successful digital forensic investigations
depend on both technical proficiency and strict adherence to forensic
methodology.

[Link] Joshi (WS-50 (AB2,FB3)) DF 74 / 75

 Module 2

End of Module 2: Reflection

Which is more critical in digital forensics?

Using advanced forensic tools OR Following correct forensic
procedures?

This module demonstrates that while tools enable investigations,

procedural discipline determines whether evidence survives legal
scrutiny.

[Link] Joshi (WS-50 (AB2,FB3)) DF 75 / 75