# Forensic Imaging

> Master forensic imaging. Learn to create bit-for-bit copies of digital evidence using write-blockers, understand image formats, and verify integrity with hashing.

Canonical: https://codelivly.com/rooms/forensic-imaging
Last updated: 2026-09-10

| | |
|---|---|
| Level | Intermediate |
| Category | Forensics |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 100 |

This module dives deep into forensic imaging, the critical process of creating exact, bit-for-bit copies of digital storage media for safe analysis. You will learn the absolute necessity of hardware write-blockers in preventing evidence contamination, the technical differences between raw (dd) and advanced compressed formats (E01, AFF), and the mandatory use of cryptographic hashing to verify data integrity. From a cybersecurity perspective, mastering forensic imaging ensures that investigators can thoroughly analyze data without altering the original evidence, maintaining its legal admissibility and forensic soundness throughout the entire investigation lifecycle.

## Lessons

1. What Is Forensic Imaging and Why Does It Matter (30 min)
2. Bit-for-Bit Copies vs Logical Copies (30 min)
3. Imaging with FTK Imager (30 min)
4. Verifying Image Integrity with Hashing (30 min)
5. Guided Lab: Creating and Verifying a Forensic Disk Image (30 min)

## Related

- [Learning path: Digital Forensics Fundamentals](https://codelivly.com/learning-paths/digital-forensics-fundamentals)
- [All rooms](https://codelivly.com/rooms)