Data acquisition and duplication is the process of making a perfect bit-for-bit copy of a storage device, such as a computer hard drive, for use as evidence in an investigation. This concept matters for the 312-49 exam because an improper acquisition can destroy evidence, ruin a prosecution, or get an entire forensic report thrown out of court.
Jump to a section
A simple way to picture Data Acquisition and Duplication Techniques
A personal safe deposit box at a bank holds your most important physical items — birth certificates, property deeds, or valuable jewellery. You open the box with your key and the bank uses its key. The entire box is a single, sealed container. Creating a precise copy of that box is not about listing what is inside. It is about making a perfect replica of the entire box, including the metal sides, the lock mechanism, the felt lining, and every single item inside, exactly as they sit. You lift the whole box out, place it into a duplicate shell, and seal the new box with the same lock. The exact scratches on the items, the way a necklace is folded, the order of the papers — every tiny detail is preserved. A simple inventory list would miss the fact that a stamp on a deed is tilted two degrees to the left. A police officer searching the box might move a document and change the arrangement. But a forensic duplicate does not change anything. It creates a second box that is a mirror image of the original, down to the last fibre. This process is what data acquisition and duplication does for digital evidence. The hard drive is the safe deposit box. The files are the important documents inside. The forensic image is the perfect replica of the entire box, including the spaces between the documents and the order they are stored in.
Data acquisition and duplication is the first and most critical step in a digital forensic investigation. It is the process of creating an exact, forensically sound copy of a storage device. This copy, called a forensic image, is the evidence that investigators analyse. The original device is never touched during analysis.
Understand the problem that this process solves. Computer storage devices, such as hard disk drives (HDDs), solid state drives (SSDs), USB flash drives, and memory cards, all store data in a specific physical or electronic arrangement. When an investigator plugs a suspect device into a computer to browse files, the operating system (OS) automatically makes changes. The OS writes temporary files, updates access timestamps, or moves data around. Even simply turning on a computer can alter thousands of files. A forensic expert cannot afford to change anything on the original evidence.
The solution is to create a forensic image using a hardware write blocker. A write blocker is a device that sits between the suspect drive and the forensic workstation. It allows the forensic computer to read data from the suspect drive, but it blocks any write command. The forensic computer cannot accidentally or deliberately write anything back to the suspect drive. This preserves the original evidence exactly as it was found.
Once the write blocker is connected, the investigator uses acquisition software to make the image. This software reads every single bit — each 1 or 0 — from the suspect drive. It does not just copy files. It copies the entire structure of the drive, including the areas where no files appear to exist, such as the slack space. Slack space is the leftover area at the end of a file cluster that may contain fragments of previously deleted files. It also copies the unallocated space, which is the area where deleted files still physically reside on the drive. A standard file copy would ignore both of these areas.
There are three main methods of data acquisition:
Static acquisition: The device is seized, turned off, and imaged in a controlled lab environment. This is the most common method and is considered the gold standard for evidence integrity.
Live acquisition: The device is running and cannot be shut down without losing volatile data. Volatile data is information stored in memory (RAM) that disappears when the power is cut, such as running processes, network connections, and encryption keys. The investigator runs tools on the live system to collect this data before imaging the hard drive.
Logical acquisition: Only specific files or folders are collected, rather than the entire drive. This is faster but may miss evidence in unallocated space or slack space. It is used when time is critical and only certain directories are relevant.
The actual forensic image can be stored in two main types:
A raw image (often with a .dd extension): A simple bit-for-bit stream of the entire device. It is fast to create and widely compatible, but it does not compress data.
An expert witness format image (often with .e01 or .ex01 extension): A compressed, segmented image format that also stores metadata such as the date, time, and case number. It can also include a hash value, which is a unique digital fingerprint of the data.
After the image is created, the investigator verifies its integrity using hashing algorithms. A hash algorithm, such as MD5 or SHA-1, computes a fixed-length string from the data on the original drive. The same computation is done on the forensic image. If the two hashes match, the image is an exact duplicate. If even one bit is different, the hashes will be completely different.
The chain of custody is also documented. This is a written record that tracks who handled the evidence, when, where, and for what purpose. A break in the chain of custody can make the evidence inadmissible in court.
In summary, data acquisition and duplication is not just copying files. It is a rigorous, documented process that preserves the entire state of a storage device while ensuring the original evidence remains unchanged.
Identify and secure the device
The investigator locates the suspect device, such as a laptop or hard drive. The device is photographed in place and labelled. The investigator documents the state of the device: is it on, off, or in sleep mode? This information determines the next step.
Capture volatile data (if live acquisition is needed)
If the device is running and contains volatile data (RAM), the investigator uses tools to dump the memory contents. This may include running processes, network connections, and encryption keys. This data is written to an external USB drive.
Shut down the device and remove the storage media
The investigator performs a controlled shutdown to avoid corrupting data. Then the hard drive, SSD, or other storage media is physically removed from the device. The drive is placed in an antistatic bag and sealed with a tamper-evident seal.
Connect the drive through a hardware write blocker
The suspect drive is connected to a hardware write blocker, which is then connected to the forensic workstation. The write blocker ensures that only read commands are sent to the suspect drive. Any write commands are blocked, preserving the original evidence.
Create the forensic image using acquisition software
The investigator opens acquisition software (e.g., FTK Imager or EnCase) and selects the source drive. The destination drive is a clean, sterile external drive. The investigator chooses the image format (raw .dd or Expert Witness .e01) and enters case metadata. The software then reads every bit from the source and writes it to the destination.
Verify the image with hashing
After acquisition, the software computes a hash value for both the original drive and the forensic image. The two hash values are compared. If they match, the image is an exact, forensically sound duplicate. The hash values are recorded in the case report.
Document chain of custody and store evidence
The investigator fills out chain of custody forms, noting who imaged the drive, when, and where. The original drive is placed in secure storage with restricted access. The forensic image is used for analysis, and the original is never touched again.
An IT professional working as a forensic analyst for a company receives a call at 3:00 PM. A sales manager has been suspected of stealing customer data and selling it to a competitor. The employee has just been confronted and is about to be escorted out of the building. The analyst must preserve all data on the manager's company-issued laptop before the employee leaves.
The analyst first prepares a forensic acquisition kit. The kit includes:
A forensic laptop with acquisition software such as FTK Imager or EnCase.
A hardware write blocker, specifically a Tableau or Wiebetech device.
A clean, unused external hard drive to store the image.
Evidence bags, tamper-evident seals, and chain of custody forms.
The analyst meets the security team at the manager's desk. The laptop is still running. The manager has just logged off but the machine is on. The analyst must decide between a live acquisition and a static acquisition.
Because the laptop is already on and the manager may have encrypted drives, the analyst chooses a live acquisition. The analyst plugs a USB drive containing a forensic tool into the laptop. The tool captures the contents of the RAM — the volatile memory — which may contain encryption keys, open emails, or chat conversations. This step takes about five minutes. The analyst writes down every action and the exact time in a notebook.
After capturing the volatile data, the analyst shuts down the laptop using a controlled shutdown procedure. The analyst then removes the hard drive. The drive is labelled with the case number, date, time, and the analyst's initials. The drive is placed in an antistatic bag and sealed in an evidence bag with a tamper-evident seal.
Back in the forensic lab, the analyst connects the suspect hard drive to the write blocker. The write blocker is connected to the forensic workstation. The analyst opens the acquisition software and selects the source drive. The destination is the clean external hard drive. The software is set to create an Expert Witness format image. The analyst enters the case metadata: case number, examiner name, notes.
Acquisition begins. For a 500GB drive, this takes approximately two hours. The software displays a progress bar. During this time, the analyst cannot use the forensic workstation for any other task. The analyst completes the chain of custody form, documenting that the drive was imaged from 3:45 PM to 5:50 PM.
When the image is complete, the software automatically computes a SHA-1 hash of the original drive and a SHA-1 hash of the resulting image. The two hashes are compared and they match exactly. The analyst saves the hash values in a report.
The original hard drive is stored in a secure evidence locker. Only the forensic team has access, and every access is logged. The forensic image is the working copy. The analyst now opens the image file in forensic analysis software and begins the investigation, knowing that the evidence has not been altered.
The 312-49 exam dedicates significant weight to data acquisition and duplication. You must understand the concepts at a definitional level, but also the procedural details that separate correct from incorrect practice.
The exam loves to test the following specific areas:
Write blockers: You must know what a hardware write blocker does and why it is used. A common question presents a scenario where an investigator connects a suspect drive directly to a forensic workstation. The correct answer will always state that this violates forensic protocols because the OS may write to the drive. The exam expects you to choose the option that includes a write blocker.
Static vs. live vs. logical acquisition: The exam will describe a situation and ask which method is appropriate. If the device is turned off and there is no risk of losing volatile data, static acquisition is always the best. If the device is running and contains encrypted volumes or active network connections, live acquisition is required. Logical acquisition is only chosen when time is extremely limited and the investigator only needs specific files.
Hash verification: The exam tests why hashing is performed both before and after acquisition. Many students mistakenly think one hash is enough. The exam expects you to know that the hash of the source is computed first, then the hash of the image is computed afterwards. They must match. The phrase 'hash verification ensures data integrity' is a standard correct answer.
Image formats: The exam distinguishes between raw (.dd) and Expert Witness (.e01) formats. Raw images are uncompressed and simpler. Expert Witness formats support compression, segmentation, and metadata. A question might ask why an investigator would choose .e01 over .dd — the correct answer is usually 'to enable compression and metadata storage'.
Chain of custody: The exam tests that every transfer of evidence must be documented. A question may present a scenario where evidence is handed from person A to person B without a signature. The answer will state that this breaks the chain of custody and the evidence may be inadmissible.
The exam sets traps by using confusing terminology. For example:
They might call a 'forensic image' a 'backup'. Backups are not the same. A backup is a copy of files. A forensic image is a bit-for-bit copy of the entire storage media.
They might describe a 'logical acquisition' as 'imaging the entire drive'. This is wrong. Logical acquisition only copies specific files or folders.
They might state that 'imaging a live system is never necessary'. This is false. Live acquisition is necessary when the system cannot be shut down.
Key definitions you must memorise:
Volatile data: Data in RAM that disappears when power is lost.
Unallocated space: Area of the drive containing deleted files.
Slack space: Leftover bytes at the end of a file cluster.
Write blocker: Hardware or software that prevents writes to the evidence drive.
Hashing: Mathematical algorithm that produces a unique fingerprint of data.
Finally, the exam often asks about the order of operations. The correct sequence is: 1) Secure the scene and identify devices. 2) Capture volatile data if necessary. 3) Shut down the system properly. 4) Remove the storage device. 5) Connect the device through a write blocker. 6) Create the forensic image. 7) Verify the hash. 8) Document everything.
Data acquisition is the process of creating an exact bit-for-bit copy of a storage device, not just copying the visible files.
A hardware write blocker must be used to prevent the forensic workstation from writing any data to the original evidence drive.
A forensic image includes unallocated space and slack space, which can contain deleted files and fragments of old data.
Hash verification (using MD5 or SHA-1) is performed on the original drive and on the image to confirm the image is an exact duplicate.
Static acquisition is the gold standard and should be used whenever the device can be turned off safely.
Live acquisition is required when volatile data in RAM must be captured before the system is shut down.
Chain of custody documentation is mandatory for every piece of evidence and every transfer of that evidence.
The Expert Witness format (.e01) is preferred in forensic investigations because it supports compression and stores metadata.
These come up on the exam all the time. Here's how to tell them apart.
Static Acquisition
Device is powered off before imaging.
No volatile data is captured.
Preferred method because it prevents any changes to the evidence.
Live Acquisition
Device is running during the process.
Volatile data such as RAM contents are captured first.
Used when the system cannot be shut down or encrypted volumes are present.
Raw Image Format (.dd)
Uncompressed bit-for-bit copy of the device.
No built-in metadata storage.
Faster to create but requires more storage space.
Expert Witness Format (.e01)
Compressed and can be split into multiple files.
Stores case metadata, examiner notes, and hash values.
Slower to create but uses less storage and includes extra information.
Hardware Write Blocker
Physical device that sits between the drive and the workstation.
Cannot be bypassed by malware or operating system bugs.
Required by most forensic standards and accepted in court.
Software Write Blocker
Software driver that intercepts write commands at the OS level.
Can be bypassed or disabled, especially if the OS is compromised.
Not recommended for forensic acquisitions of suspect drives.
Logical Acquisition
Only copies selected files and folders.
Does not capture unallocated space or slack space.
Faster and useful for targeted collection of specific data.
Physical (Bit-for-Bit) Acquisition
Copies every bit of the entire storage device.
Includes all hidden areas, deleted files, and file system metadata.
Slower but provides a complete forensic image.
Mistake
A forensic image is the same as a backup or a copy of the files on the drive.
Correct
A forensic image is a bit-for-bit copy of the entire storage device, including all unallocated space, slack space, and file system metadata. Backups only copy individual files.
Beginners are familiar with copying files and folders and assume that is sufficient. They do not yet understand that deleted files and hidden data exist in areas a normal copy ignores.
Mistake
Any computer can be used to image a suspect drive, as long as the acquisition software is installed.
Correct
The forensic workstation must be free of malware and the suspect drive must be connected through a hardware write blocker to prevent any writes to the evidence.
People think software alone is adequate because they do not realise that the operating system itself writes data when it mounts a drive.
Mistake
Hashing is optional and only needed if the court requests it.
Correct
Hashing is mandatory for every forensic acquisition to prove that the image is an exact duplicate of the original. Without matching hashes, the evidence is not forensically sound.
Many beginners think hashing is a 'nice-to-have' feature. They do not understand that it is the only objective way to verify data integrity.
Mistake
A live acquisition is always better because it captures more data.
Correct
Static acquisition is preferred whenever possible because it does not change the evidence. Live acquisition is only used when the system cannot be shut down or volatile data is needed.
The word 'live' sounds more thorough. Beginners mistakenly believe that more data always means better evidence.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A forensic image is an exact bit-for-bit copy of an entire storage device, including unallocated space and slack space. A backup only copies the files and folders that the operating system sees.
A hardware write blocker is required because it physically interrupts any write command before it reaches the suspect drive. Software read-only modes can be bypassed by malware or driver bugs, and courts expect the highest level of protection.
Volatile data is information stored in a computer's RAM that is lost when the power is turned off. It includes running processes, network connections, and encryption keys. It is important because it can show what the user was doing at the exact time of seizure.
Yes, but you need the decryption key. During a live acquisition, you can capture the encryption key from RAM before shutting down. Without the key, the image will contain encrypted data that cannot be analysed without a password.
A standard 500GB hard drive over USB 3.0 typically takes two to three hours. Larger drives or drives connected via slower interfaces can take much longer. The speed depends on the size of the drive, the interface, and whether compression is used.
If the hashes do not match, the image is not a valid forensic copy. The investigator must delete the image and start the acquisition process again. A mismatch could indicate a hardware failure, a write event, or an error in the acquisition process.
No. Even mounting a drive as read-only in an operating system is not safe because the OS may still write volume mount information or update log files. A hardware write blocker is the only acceptable method.
You've finished Data Acquisition and Duplication Techniques. Continue through the 312-49 study guide to build a complete picture of the exam.
Done with this chapter?