Understanding Disk Acquisition

Disk acquisition creates a controlled representation of storage media so analysis can proceed without repeatedly interacting with the original source.

What you will learn

By the end, you should be able to distinguish physical and logical acquisition, explain integrity verification, and plan a documented imaging workflow.

Disk acquisition

Core concept

A disk acquisition copies selected storage content into an evidence file or controlled destination. A physical image aims to include addressable sectors, including unallocated space; a logical acquisition copies selected files or volumes visible through the operating system or acquisition tool.

Source mediaImage formatHashesLogsChain of custody

Keep in mind: A hash supports integrity comparison; it does not by itself prove who collected the evidence, whether the method was appropriate, or whether the source was complete.

01Physical imageA sector-oriented representation of storage media02Logical acquisitionSelected files or data exposed through a file system03Write blockerA control intended to prevent writes to source media

Acquisition choices

Physical acquisitionUse when allocated and unallocated storage may be relevant

Logical acquisitionUse for selected accessible files or constrained collection

Live acquisitionUse when encryption or availability makes shutdown unsuitable

Offline acquisitionUse to reduce source-system activity where practical

Why it matters

Protect the source

Analysis can be repeated from a controlled image while original media remains preserved.

Retain storage context

Physical imaging may preserve partitions, metadata, deleted records, and unallocated areas.

Verify integrity

Recorded hashes allow later comparisons between the acquired image and working copies.

Support review

Acquisition notes allow another examiner to understand the source, method, settings, and limitations.

Acquisition workflow

1. PlanRecord authority, source identity, capacity, encryption, destination, and acquisition objective.
2. ProtectUse an appropriate write-protection method and document unavoidable live-system changes.
3. AcquireSelect the image type, format, segmentation, and destination, then monitor errors.
4. VerifyCalculate and compare supported integrity hashes and confirm expected image size and structure.
5. PreserveLabel and store the image, logs, hashes, notes, and chain-of-custody information.

Practice scenario

01 · PlanYou must acquire a 2 TB drive. The evidence destination has only 1.2 TB free. What should you do first?

Start imaging and hope compression is sufficientReassess the plan and provide a suitable controlled destinationDelete large files from the source before imaging

Check the source, destination and expected output before starting.

02 · AcquireThe case asks whether files were deleted from a training USB. Which approach best preserves relevant evidence?

Create a physical image through write protection and record the device identityCopy only the visible files in File ExplorerOpen files on the source to see which matter

Match the acquisition method to the evidence question.

03 · VerifyThe image completes, but the verification hash does not match. What is the defensible outcome?

Rename the image and continuePreserve the logs, investigate the mismatch and reacquire if the source and authority permitDelete the log so the image can be analysed

A completed progress bar is not the same as a verified acquisition.

Quality checklist

Make the result reproducible

1. 1IdentifyRecord media identifiers, condition, interfaces, and capacity.
2. 2ControlDocument write protection and the acquisition environment.
3. 3VerifyRecord hashes, tool logs, errors, and image properties.
4. 4PreserveStore originals and create verified working copies.

!Plan for acquisition friction

Large mediaBad sectorsEncryptionRAIDInsufficient storageUnstable interfaces

Document read errors, retries, skipped areas, and any difference between the intended and completed acquisition.

Choose a tool

Image and preview

FTK Imager

Create forensic images, preview supported sources, export selected files, and retain acquisition hashes and logs for review.

Open the FTK Imager learning journey ›

Continue learning

• Explore FTK Imager for the practical acquisition workflow.
• Continue to Understanding Disk Image & Recovery before examining an acquired image.