Forensic Imaging or Forensic Acquisition is the process where the entire drive contents are imaged to a file and checksum values are calculated to verify the integrity (in court cases) of the image file (often referred to as a “hash value”). Forensic images are acquired with the use of software tools. (Some hardware cloning tools have added forensic functionality.)
