NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Forensic Imaging
Master forensic imaging. Learn to create bit-for-bit copies of digital evidence using write-blockers, understand image formats, and verify integrity with hashing.
Room tasks
1What Is Forensic Imaging and Why Does It Matter
2Bit-for-Bit Copies vs Logical Copies
3Imaging with FTK Imager
4Verifying Image Integrity with Hashing
5Guided Lab: Creating and Verifying a Forensic Disk Image
Frequently Asked Questions
What is forensic imaging?
Forensic imaging creates an exact bit-for-bit copy of a storage device so analysis can be done on the copy while the original stays untouched. Hash values prove the copy matches.
What does a write-blocker do?
A write-blocker allows data to be read from a drive while preventing any writes. This stops accidental changes to evidence during acquisition and supports its admissibility.
What is the difference between E01 and raw images?
Raw (dd) images are plain sector copies, while E01 files add compression, metadata and integrity checks. This free intermediate Codelivly room explains both and how to create them.