Subject: Digital Forensics

Topic: Initial response and forensic duplication

Difficulty: High

A simple duplication consists of making a copy of specific data. The data may consist of a single file, a group of files, a partition on a hard drive, an entire hard drive, or other elements of data storage devices and the information stored on them.

A forensic duplication is an accurate copy of data that is created with the goal of being admissible as evidence in legal proceedings.

Furthermore, we define forensic duplication as an image of every accessible bit from the source medium.

We encourage you to consider all data you collect as evidence that may contribute to a legal process. To that end, you should perform duplication with methods that are generally accepted in the forensic community.

Type of image formats are

1. Complete image
2. Partition
3. Logical