Forensic Acquisition and Imaging

Introduction

Forensic acquisition is the controlled process of collecting digital information in a manner that preserves its evidential value. It is the foundation of cyber-forensic examination: if the acquisition is incomplete, altered, poorly documented, or technically unsuitable, later analysis may be unreliable even when the examiner uses excellent tools.

Acquisition is not simply copying files. It involves selecting an appropriate source, determining what information may be lost or changed, using methods that minimise alteration, recording actions, preserving provenance, and verifying that the acquired data corresponds to the source. In cyber law, these technical requirements are closely connected to admissibility, authenticity, integrity, relevance, proportionality, privacy, and the right to challenge evidence.

The examiner must distinguish between live and dead acquisition, and between logical and physical acquisition. These categories describe different states of the system and different levels of access to storage. The correct choice depends on the investigative question, the device, encryption status, risk of data loss, legal authority, and available resources.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Distinguish live, dead, logical, and physical acquisition.
2. Explain why volatile data may require immediate collection.
3. Describe the stages of forensic imaging and verification.
4. Select proportionate acquisition methods for common investigative situations.
5. Identify challenges involving encryption, damaged media, proprietary systems, and large-scale data.
6. Explain the legal, ethical, and governance requirements for defensible acquisition.

1. Acquisition as an Evidential Process

A digital device contains many kinds of information. Some information is readily visible to the operating system, such as documents and photographs. Other information exists in file-system metadata, deleted space, slack space, partitions, system areas, application databases, memory, logs, or network connections. The acquisition method determines which of these categories can be preserved.

A sound acquisition process has five characteristics:

• Authenticity: the examiner can show where the data came from.
• Integrity: the data has not been altered after collection, or any alteration is documented and controlled.
• Completeness: the acquired dataset is sufficient for the stated purpose, with limitations disclosed.
• Repeatability: another competent examiner can understand and, where possible, reproduce the process.
• Proportionality: the scope and intrusiveness of collection are justified by the investigative purpose.

A forensic image is a bit-for-bit representation of a storage source or a defined portion of it. The term is sometimes used loosely for any forensic collection, but a logical export of selected files is not equivalent to a physical image of an entire drive.

Important terminology

2. The Four Principal Acquisition Categories

2.1 Live acquisition

Live acquisition occurs while the device is powered on and its operating system is running. It is used when important information exists only in the current system state or when shutting down the system would cause unacceptable loss.

Potentially valuable volatile information includes:

• contents of RAM;
• running processes and loaded modules;
• logged-in users and active sessions;
• network connections and routing information;
• encryption keys held in memory;
• mounted encrypted volumes;
• clipboard contents;
• temporary files and command histories; and
• system time, uptime, and current configuration.

Live acquisition has an unavoidable disadvantage: interacting with the system changes it. Running a tool consumes memory, creates processes, changes access times in some environments, and may modify logs. The objective is therefore not to claim that live acquisition causes no change, but to minimise, understand, and document change.

A typical live-response order proceeds from the most volatile information to less volatile information. The exact order depends on the system and investigation, but an examiner may begin with system time, network state, logged-in users, processes, memory, and relevant temporary data before collecting persistent storage. The examiner should use trusted tools from verified media and record every command and result.

Live acquisition is especially important in ransomware, intrusion, insider-threat, and encrypted-device cases. It may also be the only practical method when a cloud-connected or operational system cannot safely be shut down.

2.2 Dead acquisition

Dead acquisition occurs when the target system is powered off, or when storage is removed and acquired independently of the original operating system. The source is normally connected to a forensic workstation through a write blocker.

The principal advantage is stability. The original operating system does not boot, mount, update, index, or write to the evidence. This makes physical imaging more defensible and repeatable. Dead acquisition is generally preferred for ordinary powered-off storage when volatile information is not required or has already been collected.

The term “dead” does not mean that the evidence is unimportant or damaged. It describes the acquisition state. A powered-off laptop with full-disk encryption may still require a live strategy if the encrypted volume cannot be accessed without keys present in memory.

2.3 Logical acquisition

Logical acquisition collects objects presented by a file system, operating system, application, cloud service, or device interface. Examples include selected documents, email mailboxes, browser histories, mobile-device backups, and cloud records obtained through an export function.

Logical acquisition is often faster and less intrusive than physical imaging. It may be appropriate when the investigation concerns a specific account, folder, application, or date range. It is also useful where physical access is unavailable, such as some cloud environments.

However, logical acquisition may omit deleted files, unallocated space, hidden partitions, file-system structures, and artefacts inaccessible through ordinary permissions. Some tools also transform timestamps, normalise file names, or export only a provider-defined subset. These limitations must be recorded.

2.4 Physical acquisition

Physical acquisition captures storage at the sector, block, chip, or equivalent low-level layer. It can include active files, deleted data, unallocated space, slack space, partition structures, and remnants of previous file-system activity.

Physical acquisition provides a broad evidential base, but it requires more storage, time, specialist knowledge, and careful interpretation. It does not guarantee recovery of every deleted file. Solid-state drives may perform garbage collection and wear-level management; encryption may make acquired sectors unintelligible; and damaged sectors may be unreadable.

Physical acquisition is normally preferred when the investigative question is broad, deletion or concealment is suspected, or the examiner must preserve the original storage structure for later analysis. It may be excessive where a narrowly defined logical collection is sufficient and legally authorised.

Comparison of methods

3. Planning an Acquisition

Acquisition should begin with a plan, not with a tool. The examiner should clarify the investigative question and identify the authority under which collection occurs. A plan normally addresses:

1. Scope: Which devices, accounts, users, time periods, and data categories are relevant?
2. State: Is the system on, off, locked, network-connected, encrypted, or damaged?
3. Volatility: What may disappear if power is removed or the device is isolated?
4. Authority: Does the warrant, consent, policy, or order authorise the proposed collection?
5. Method: Is logical, physical, live, dead, or combined acquisition required?
6. Risk: Could collection interrupt essential services, destroy evidence, or expose unrelated private data?
7. Resources: Are there sufficient storage, specialist tools, time, and trained personnel?
8. Verification: How will acquisition success and integrity be demonstrated?

The examiner should photograph the device, its connections, labels, screens, and surrounding condition where permitted. Record date, time, location, device identifiers, power state, visible encryption indicators, network connections, and any actions taken before acquisition.

A legal authority to seize a device does not automatically authorise unlimited examination of every item stored on it. Investigators should use minimisation, filtering, review protocols, segregation, and access controls where privacy or privilege is at stake.

4. The Imaging Workflow

Step 1: Secure and identify the source

The device should be secured against unauthorised access and assigned an evidence identifier. Record make, model, serial number, storage capacity, interface, condition, and visible damage. For removable media, document adapters and enclosures used.

Step 2: Decide whether live preservation is necessary

If the system is on, the examiner must decide whether shutting it down would destroy volatile evidence or encryption keys. If immediate danger exists, such as active wiping or remote destruction, isolation may be necessary. Network isolation must be carefully selected: disconnecting a cable, disabling a wireless interface, or using a controlled shielded container can have different consequences.

Step 3: Select a suitable acquisition method

Use physical acquisition when the investigative question requires deleted or low-level content and the device supports it. Use logical acquisition when a targeted, proportionate collection is sufficient. Use live acquisition when volatile information or mounted encryption keys are material. More than one method may be necessary.

Step 4: Prevent unintended writes

For dead storage, a validated write blocker is normally used. The examiner should verify that the source is recognised correctly and that the blocker reports the expected device. A write blocker is not a substitute for documentation: its make, model, serial number, mode, and validation status should be recorded.

Step 5: Create the image

The destination must have adequate capacity and be securely controlled. Imaging software should record source and destination identifiers, start and end times, acquisition mode, sector or block errors, compression, splitting, and tool versions. If bad sectors are encountered, the tool’s error-handling behaviour must be understood. Silent substitution of unreadable sectors is unacceptable; errors must be preserved in the record.

Common image formats include raw formats and proprietary or open forensic container formats. A raw image is simple and widely interoperable but may require separate metadata. A forensic container may support compression, segmentation, embedded case information, and error records. The choice should be justified by interoperability, validation, preservation, and disclosure requirements.

Step 6: Calculate and record hashes

A cryptographic hash maps input data to a fixed-length digest. If the same data is hashed with the same algorithm and procedure, the expected result is the same. A changed input should produce a different digest with extremely high probability, although a hash is not proof of authorship, truth, or absence of all possible tampering.

For a byte sequence with length n bytes, the image size is ordinarily recorded in bytes and may be converted using a stated convention. Under binary units, 1 KiB = 1024 bytes and 1 MiB = 1024² bytes. Under decimal SI units, 1 kB = 1000 bytes and 1 MB = 1000² bytes. Mixing these conventions can create apparent discrepancies.

A useful integrity relationship is:

where H_source is the hash calculated over the source data read during acquisition and H_image is the hash calculated over the resulting image data, provided that the same byte sequence, ordering, and algorithm are used. In practice, some tools calculate a source hash while reading and an image hash over the stored image; the report must explain exactly what each digest covers.

Hash algorithms should be selected according to current institutional policy and legal expectations. A modern collision-resistant algorithm is generally preferred. Older algorithms may be retained for compatibility, but relying on a single obsolete digest is poor practice. Multiple hashes can support interoperability, but they do not replace secure custody and documentation.

Step 7: Verify the result

Verification should include:

• comparison of recorded source and image identifiers;
• confirmation that the expected capacity and partitions are present;
• review of acquisition logs and error lists;
• recomputation of image hashes where appropriate;
• confirmation that image segments are complete and correctly ordered; and
• test opening of a working copy rather than the original evidence.

Verification is not only a mathematical exercise. An image may have a valid hash and still be the wrong device, an incomplete logical export, or a technically unreadable capture. Identity, completeness, integrity, and interpretability must all be assessed.

Step 8: Preserve the original and analyse a copy

The original source and master image should be protected from routine examination. Analysts should work from verified working copies. Access should be controlled, and any conversion, mounting, decryption, or repair should occur on a copy with the action documented.

5. Volatile Data and Encryption

Volatility creates a conflict between preservation and alteration. Removing power may preserve the disk in a stable condition but eliminate RAM contents, active sessions, and keys. Keeping power applied may preserve those items but permit background processes, remote commands, or scheduled tasks to change the system.

A reasoned decision should consider:

• whether volatile evidence is relevant to the allegation;
• whether the system is actively communicating or being destroyed;
• whether encryption keys may be present in memory;
• whether a trusted live tool and trained examiner are available; and
• whether business continuity or safety limits intervention.

Encryption changes the acquisition problem rather than making evidence impossible. If a device is unlocked, live acquisition may preserve accessible content and memory-resident keys. If it is powered off and strongly encrypted, a physical image may consist of ciphertext and may not provide immediate access to user data. Investigators must not assume that a password can lawfully or technically be bypassed. Credentials, recovery keys, enterprise key escrow, lawful provider processes, or specialist techniques may be relevant, subject to authority and policy.

Decryption should normally be performed on a working copy. The examiner should preserve the encrypted original, record the method and software used, and distinguish the decrypted derivative from the original acquisition.

6. Damaged Media and Acquisition Failure

Damaged media may have failing electronics, unreadable sectors, broken connectors, unstable power, or logical corruption. Repeated attempts to read a failing device can worsen its condition. The priority is to preserve the source and obtain specialist advice.

A controlled approach may include:

1. documenting the damage before connection;
2. using suitable power regulation and compatible interfaces;
3. acquiring readable areas with error logging;
4. avoiding unnecessary repeated reads;
5. creating a partial image when a complete image is impossible;
6. recording sector ranges that could not be acquired; and
7. obtaining a specialist laboratory report where repair or chip-level techniques are used.

A partial image is not equivalent to a complete image. The report must identify missing ranges and explain their likely evidential significance. For solid-state media, deleted-data recovery is also limited by TRIM, garbage collection, over-provisioning, and controller behaviour. An absence of recovered deleted data should not automatically be interpreted as proof that deletion never occurred.

7. Proportionality, Privacy, and Governance

Forensic acquisition can expose intimate communications, health information, financial records, trade secrets, and data about people who are not suspects. Proportionality requires a rational relationship between the scope of collection and the purpose of the investigation.

Practical safeguards include:

• collecting only identified devices or accounts where possible;
• using date, user, file-type, or keyword filters when legally appropriate;
• separating privileged or confidential material;
• restricting analyst access through role-based controls;
• encrypting evidence at rest and in transit;
• retaining audit logs;
• documenting deviations from the original plan; and
• applying retention and secure-destruction rules.

A broad physical image may be justified by suspected wiping or concealment, but it should not become an excuse for unrestricted curiosity. Conversely, an overly narrow logical collection may fail to preserve exculpatory or contextual evidence. Proportionality is therefore a reasoned balance, not simply a preference for collecting less data.

Different jurisdictions impose different rules concerning search authority, privacy, interception, cross-border transfers, admissibility, disclosure, and expert testimony. Examiners should follow applicable law, organisational policy, professional standards, and court directions. Technical competence cannot cure a lack of legal authority.

8. Case Study: An Encrypted Laptop in an Insider-Threat Investigation

This is an illustrative case. A company suspects that an employee copied confidential design files before resignation. The employee’s laptop is found powered on, logged in, and connected to the corporate network. Full-disk encryption is enabled. The organisation’s policy permits an authorised investigation, and counsel confirms the scope.

Problem

If investigators power off the laptop, they may preserve the storage in a stable state but lose the unlocked volume and encryption keys. If they continue using the laptop without controls, remote deletion or alteration may occur.

Analysis

The investigative questions concern recent file access, removable-media use, active cloud sessions, and possible copying. Volatile memory and current sessions may therefore be relevant. A dead physical image alone may be inaccessible because the disk is encrypted.

Approach

The team photographs the screen and device, records the time, and isolates the laptop from external networks using an approved method that does not unnecessarily change local evidence. A trained examiner performs a documented live response using verified tools. The examiner records active users, network connections, processes, mounted volumes, and memory, while noting that the collection changes system state.

The team then acquires relevant logical material from the unlocked system and preserves encryption-related information according to policy. After documenting the live stage, the device is shut down under controlled conditions. The storage is removed, connected through a validated write blocker, and physically imaged. The image, source-read hash, image hash, tool versions, errors, and chain-of-custody entries are recorded.

Analysis occurs on working copies. Investigators correlate file-system metadata, endpoint logs, cloud audit records, and removable-media history. They do not treat a file-access timestamp alone as proof that the employee copied a file; corroborating evidence is required.

Outcome

The live collection preserves an active cloud session and encryption context. The physical image preserves the storage structure for independent examination. Corporate logs show that a group of files was uploaded to an authorised personal transfer service during the relevant period. The report distinguishes observed facts, technical interpretations, and conclusions, and identifies the limits of timestamp reliability.

Learning points

1. Acquisition method should follow the evidential question.
2. Encryption may make live preservation especially important.
3. Combining live, logical, and physical acquisition can be justified.
4. Isolation and collection inevitably involve documented changes.
5. Correlation is stronger than relying on one artefact.
6. A technically successful acquisition still requires lawful authority and careful reporting.

9. Contemporary Developments and Professional Practice

Cloud services, mobile devices, virtual machines, containers, remote work platforms, and Internet-of-Things systems have expanded the meaning of “source media.” Evidence may be distributed across local storage, provider systems, synchronisation databases, and application logs. A physical image of one device may therefore be only one component of a complete acquisition strategy.

Cloud acquisition is often logical or provider-mediated. Examiners should record the account identifier, provider, collection authority, export method, time zone, time range, API or portal used, and provider-generated metadata. Hashing an export verifies the acquired export, not necessarily every internal state of the provider’s infrastructure.

Artificial intelligence can assist with triage, classification, deduplication, and anomaly detection, but it does not replace preservation and verification. AI-generated classifications are interpretations that require validation, explainability, and human review. Training data, model version, confidence thresholds, and false-positive risks should be documented when AI materially affects examination or reporting.

Best practice is founded on validation rather than brand preference. Tools should be tested against known datasets, including normal, damaged, encrypted, and deliberately altered media. Examiners should maintain competence in file systems, operating systems, storage technologies, cryptographic integrity, privacy, and evidential reporting.

Chapter Summary

Forensic acquisition is the controlled preservation of digital information for reliable examination and possible legal use. Live acquisition captures volatile information but changes the running system; dead acquisition provides greater stability but may lose memory contents and encryption keys. Logical acquisition is targeted and efficient but may omit deleted or low-level data. Physical acquisition preserves a broad representation of storage but requires more time, capacity, expertise, and careful interpretation.

A defensible workflow identifies the source, plans for volatility and authority, uses appropriate write protection, creates a documented image, records errors and tool settings, calculates and verifies hashes, preserves the original, and analyses working copies. Encryption, damaged media, solid-state storage, cloud environments, and large datasets require specialised decisions. Integrity hashes support change detection, but they do not prove relevance, authorship, or legal admissibility by themselves.

Finally, acquisition must be proportionate, privacy-aware, and legally authorised. Technical completeness must be balanced with minimisation, confidentiality, security, and transparent reporting.

Key Terms

Acquisition: The controlled collection of digital data from a source.

Live acquisition: Collection while a system is powered on and operating.

Dead acquisition: Collection after shutdown or from detached storage.

Logical acquisition: Collection through an operating system, application, or service interface.

Physical acquisition: Low-level collection of sectors, blocks, chips, or equivalent storage content.

Forensic image: A documented representation of acquired digital data.

Volatile data: Data that may disappear when power or system state changes.

Write blocker: A mechanism intended to prevent writes to source media.

Hash value: A fixed-length digest used to detect changes in data.

Integrity: Confidence that data has not been altered without detection.

Authenticity: Ability to establish the identity and origin of evidence.

Chain of custody: Documented history of evidence possession and handling.

Unallocated space: Storage not currently assigned to an active file.

Slack space: Unused space within an allocated storage cluster.

Encryption: Transformation of data so that access requires an appropriate key.

Image verification: Checking that an acquired image is complete, correctly identified, and internally consistent.

Proportionality: Relationship between investigative purpose and collection scope.

Working copy: A verified duplicate used for examination instead of the original.

Write error: Failure to read or preserve a portion of source media during acquisition.

Review Questions

Short Answer Questions

1. What is the principal difference between live and dead acquisition?
2. Why might a physical image contain information that a logical acquisition does not?
3. What is the purpose of a write blocker?
4. What does a cryptographic hash help an examiner demonstrate?
5. Why should examination normally be performed on a working copy?

Long Answer Questions

1. Compare live, dead, logical, and physical acquisition, including their main strengths and limitations.
2. Explain a complete forensic imaging workflow from source identification through verification and preservation.
3. Discuss how full-disk encryption affects acquisition strategy.
4. Explain why proportionality and privacy are important in forensic acquisition.
5. Describe appropriate procedures for acquiring damaged storage media.

Analytical / Application Questions

1. A powered-on laptop is encrypted, connected to a network, and suspected of active remote wiping. Recommend an acquisition sequence and justify each stage.
2. An examiner creates a logical export of selected emails when the investigation later reveals suspected deletion and use of hidden partitions. Evaluate the adequacy of the acquisition and propose further steps.
3. A physical image has a valid hash but contains unreadable sectors and was created from a device whose serial number was not recorded. Analyse the evidential limitations and identify corrective actions.

Multiple Choice Questions with Answers

Question 1

Which acquisition method is most suitable for preserving RAM contents and encryption keys that may disappear after shutdown?

A. Live acquisition

B. Dead acquisition

C. Logical acquisition after formatting

D. Physical acquisition of an unplugged drive

Correct Answer: A. Live acquisition

Question 2

What is the principal purpose of a write blocker?

A. To accelerate file deletion

B. To prevent unintended writes to source media

C. To decrypt a storage device

D. To compress a forensic image

Correct Answer: B. To prevent unintended writes to source media

Question 3

Which type of acquisition generally includes unallocated space and partition structures?

A. Selected logical export

B. Application screenshot

C. Physical acquisition

D. User-created backup

Correct Answer: C. Physical acquisition

Question 4

What does equality between a source-read hash and an image hash indicate when both cover the same byte sequence?

A. The user who created the data is identified

B. The data is legally admissible in every jurisdiction

C. The source was never previously altered

D. The covered data was not changed between the compared representations

Correct Answer: D. The covered data was not changed between the compared representations

Question 5

Why can a powered-off encrypted laptop be difficult to examine?

A. The operating system automatically deletes every file

B. The required decryption key may no longer be available in memory

C. Physical images cannot contain sectors

D. Write blockers remove encryption keys

Correct Answer: B. The required decryption key may no longer be available in memory

Question 6

Which statement best describes logical acquisition?

A. It collects data through a file system, application, or service interface

B. It always captures every deleted sector

C. It requires the device to be physically destroyed

D. It is identical to chip-off acquisition

Correct Answer: A. It collects data through a file system, application, or service interface

Question 7

A failing drive contains unreadable sectors. What should the examiner do?

A. Hide the errors so the image appears complete

B. Repeat uncontrolled reads until all sectors are recovered

C. Record the errors and identify the missing ranges and limitations

D. Assume unreadable sectors contain no relevant evidence

Correct Answer: C. Record the errors and identify the missing ranges and limitations

Question 8

Which principle requires the scope of collection to be justified by the investigative purpose?

A. Compression

B. Proportionality

C. Segmentation

D. Redundancy

Correct Answer: B. Proportionality

Question 9

Why should an examiner document the image format, tool version, settings, and errors?

A. To make the original source change faster

B. To establish repeatability and explain limitations

C. To guarantee that deleted files will be recovered

D. To eliminate the need for legal authority

Correct Answer: B. To establish repeatability and explain limitations

Question 10

Which statement about a valid hash is correct?

A. It proves who authored the data

B. It proves that the investigation was proportionate

C. It helps detect changes but does not by itself establish meaning or authorship

D. It guarantees that no data was omitted during logical collection

Correct Answer: C. It helps detect changes but does not by itself establish meaning or authorship