Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: Sergioramos
New Today: 1
New Yesterday: 0
Overall: 29353

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 A question for students and newbies
 E-DISCOVERY & DATA RECOVERY? WHICH ONE IS BETTER?
 Computer Forensic in e-commerce
 Computer Forensic as component in Information Security
 Small Business - Do You Prepared?

Computer Forensics World Forums


Pages Served
We received
51193768
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - Difference between regular image and forensic image
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Difference between regular image and forensic image

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues
View previous topic :: View next topic  
Author Message
OneZ
Newbie
Newbie


Joined: Jan 06, 2015
Posts: 7

PostPosted: Wed Jan 07, 2015 5:59 am    Post subject: Difference between regular image and forensic image Reply with quote

Hello all,

I'm new to forensic and I have a question.

What is the difference between a forensic image (like the one you make with FTK) and a normal image (like the one you make with Acronis)?

Thank you.
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Wed Jan 07, 2015 10:49 am    Post subject: Reply with quote

"https://www.sans.org/reading-room/whitepapers/incident/overview-disk-imaging-tool-computer-forensics-643"

A forensic image is a bit by bit copy of the target media. Backups are typically copies of the logical files on the target media (which do not include free space).
Back to top
View user's profile
OneZ
Newbie
Newbie


Joined: Jan 06, 2015
Posts: 7

PostPosted: Wed Jan 07, 2015 12:44 pm    Post subject: Reply with quote

Thank you.
Back to top
View user's profile
mikenummerzoveel
Newbie
Newbie


Joined: Nov 30, 2011
Posts: 4

PostPosted: Fri Apr 24, 2015 9:25 pm    Post subject: Physical vs Logical image Reply with quote

A forensic image is probably what we call a physical image (bit-to-bit copy) and gives you the option to carve removed files and find other deleted data. A backup is not a physical image but a logical image and doesn't have the option to carve data.
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.