Acquisition record

Makes the copy verifiable and the method repeatable without access to the original.

Fill this in your browser and export it. A draft is saved only in this browser; nothing is sent anywhere.

A mismatch between acquisition and verification hashes invalidates the image; record it and acquire again.
For mobile extractions the 'limits' field is mandatory: state what this extraction type cannot contain.
Store recovery keys with the case record, never in this form or the image.

Source

Case number

Item number

Acquisition type

Make, model, serial / IMEI

Declared capacity / reported sectors and sector size

HPA / DCO detected

Encryption indicators observed

Device clock vs reference clock (mobile, memory)

Method

Write blocker (model, firmware, status) or isolation method

Tool and version

Output format (E01, AFF4, raw, archive) and segment size

Extraction type (mobile)

Hash algorithms

Operator

StartUTC, ISO 8601 (YYYY-MM-DDTHH:MM:SSZ)

EndUTC, ISO 8601 (YYYY-MM-DDTHH:MM:SSZ)

Result

Output file name(s) and size

Acquisition hash

Verification hash

Verification result

Read errors / tool warnings (sectors, handling)

Known limits of this acquisition (unimaged areas, extraction type gaps)

Notes

Export integrity hash (SHA-256 of the .txt export): —