Practical Forensic Imaging

3FORENSIC IMAGE FORMATS

This chapter provides an overview of the various acquisition tools, evidence containers, and forensic image formats commonly used today. Forensic image formats and evidence containers are the structures that store the forensically acquired image together with additional case data, such as the time and duration of the acquisition, how the image was acquired, size, errors, hashes, and so on. Additional features of forensic formats typically include compressed files and encryption. This chapter demonstrates command line forensic tasks using several forensic formats.

You’ll find an informative introductory paper describing ...