I85PREP
⌘ K
CCFH study materials
CCFH study resources

CCFH: Forensic Imaging, Acquisition, and Verification

CCFH · Work through your exam, one topic at a time.

All guide sections

Forensic Imaging, Acquisition, and Verification

What this domain tests

This domain tests whether you can produce a duplicate that another examiner can reproduce and verify, and whether you can explain what the verification actually proves.

Core rules and concepts

  • Acquisition scope. Physical (bit-stream) acquisition captures the whole device including unallocated space and file slack. Logical acquisition captures a file system or selected items. Sparse or targeted acquisition selects data but must be documented, because it cannot support conclusions about deleted content outside the selection.
  • Write blocking. Use a hardware bridge or a validated software blocker, and prove the block with a test write before imaging. NVMe, PCIe, and USB-C devices need compatible hardware.
  • Hidden areas. Check for and remove ATA HPA and DCO restrictions before imaging, otherwise sectors disappear from the image without any error.
  • Formats. Raw (dd) is simple and universally readable but large; E01 stores compression, case metadata, and per-block CRCs; AFF4 is an open container. Record the format and tool version in the acquisition log.
  • Hashing. MD5 for legacy compatibility, SHA-1 or SHA-256 preferred. Record both the acquired image hash and, where the tool supports it, the source verification hash.
  • What verification proves. Matching hashes show the compared streams were identical. They do not prove the read was complete or correct: bad sectors, hidden areas, or a failing drive can be read consistently and wrongly.
  • Memory acquisition. Volatile capture tools such as WinPmem, DumpIt, or LiME produce a memory image, not a device bit-stream; integrity is established by hashing the output and documenting the tool.

Worked example

A dd run reports an input/output error at sector 12345 and stops. The correct approach is to re-image with a tool that tolerates errors and logs them, such as ddrescue with a mapfile, running at least two passes and recording the error map. Image a second time and compare hashes; identical hashes across two independent acquisitions support reliability, and the error map documents which sectors could not be read. Reporting the drive as fully imaged without disclosing the error map is the error to avoid.

Traps that cost marks

  • Booting or connecting an SSD without a blocker and triggering TRIM, erasing deleted data.
  • Treating a matching hash as proof of a perfect copy.
  • Forgetting to record tool name, version, and command line.
  • Imaging only the partition when the case concerns hidden or unallocated areas.
  • Presenting a logical acquisition as if it were a full physical image.