01Purpose and scope
To produce a copy of the original medium that is complete, verifiable by hash and documented well enough that another examiner can rely on it without seeing the original.
Hard disks, solid-state drives, USB media, memory cards and virtual disks. Mobile device storage is covered by SOP-05.
02Prerequisites
- A hardware write blocker or a validated software write-blocking method, tested on this laboratory's equipment (see SOP-10).
- Sterile (wiped and verified) destination media or a verified storage volume.
- The item's intake record and custody line for examination.
03Steps
Document the medium
Photograph labels; record make, model, serial, declared capacity, interface, jumper or switch positions. Query the device for reported sector count, sector size and the presence of a host-protected or device-configuration area; record what the tool reports.
RecordDevice identification section of the acquisition record.
Connect through write protection
Connect the medium through the write blocker; confirm the blocker reports write protection active. Never rely on a device's own read-only switch.
RecordBlocker model, firmware and status.
Choose format and tool
Prefer a format that embeds metadata and hashes (E01/Ex01, AFF4) unless the request requires raw. Record tool name, version and the hash algorithms selected (SHA-256 at minimum; MD5 additionally if the requester expects it).
RecordTool, version, format, compression, segment size.
Acquire
Start the acquisition; record start time (UTC). Note every read error with sector numbers and the tool's handling (zero-fill, retry count). Do not interrupt; if interrupted, record the reason and restart with a new record.
RecordStart and end times, error list, acquisition hash.
Verify
Compute the hash of the image data and compare with the acquisition hash. For raw images, compute the hash of the file; for E01/AFF4, use the tool's verification and record its output. A mismatch invalidates the image; re-acquire.
RecordVerification hash and result.
Handle encryption and SSD specifics
Record encryption indicators (BitLocker metadata, LUKS header, FileVault). Where a recovery key is lawfully available, record its source and store it with the case, not in the image. For SSDs, note that the medium may change its own contents when powered; verify the image hash, not the source, in later checks.
RecordEncryption and medium notes.
Create and hash working copies
Copy the verified image to the analysis store; hash the copy and compare. Examination happens on the copy; the master image is stored read-only.
RecordDigital custody record for each copy.
04Records produced
- Acquisition record (device, tool, format, times, errors, hashes, operator)
- Verification result
- Digital custody record for master and working copies
05Pitfalls
- A software write blocker that was not tested on this operating system build can allow writes on mount.
- A declared capacity larger than the imaged size indicates an unimaged area; record and explain it.
- Hashing the source twice to 'verify' proves only that the source did not change; the image must be hashed.
- Read errors zero-filled by the tool look like genuine zeros in analysis; the error list must accompany the image.