What Is a Forensic Image?

Definition

A forensic image is an exact, bit-for-bit copy of a disk, memory, or virtual machine, taken in a way that does not change the original and verified with a hash. Investigators work on the copy, so the evidence of what an attacker did survives even after the system is cleaned or rebuilt.

How It Works

NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, separates two ways of copying data:

Logical backup: copies the folders and files on a volume. It misses deleted files and leftover data in unused space.
Bit stream imaging (disk imaging): a "bit-for-bit copy of the original media, including free space and slack space." It takes longer and needs more storage, but captures what the attacker tried to delete.

Three practices make an image trustworthy:

Write-blocking. A hardware or software write-blocker stops the analyst's computer from writing to the original drive while it is copied.
Hashing. A message digest (hash) is calculated for the original and the copy. NIST notes that changing a single bit produces a completely different digest, so matching hashes prove the copy is exact.
Documentation. Every step is recorded so another analyst could reproduce the image, which supports chain of custody.

Order matters. Memory, network connections, and running processes are volatile and disappear at shutdown, so responders capture them before powering a machine off. The CISA directive in the example below treated virtual machines the same way, asking for images of memory, host storage, and network data collected off the host or VM.

Real-World Example

In December 2020, CISA issued Emergency Directive 21-01 after the SolarWinds Orion compromise. Its first required action told federal agencies with the expertise to "forensically image system memory and/or host operating systems hosting all instances of SolarWinds Orion versions 2019.4 through 2020.2.1 HF1" and analyze them for new user or service accounts, before moving on to disconnecting or powering down the affected products. CISA defined expertise as trained staff with tooling "readily-available to immediately do so." Later supplemental guidance told agencies on the most affected networks not to rebuild or reimage those hosts pending consultation with CISA. Imaging came first because shutdown and rebuild would destroy the evidence.

Why It Matters for a Small Business

When a business is hacked, the urge is to wipe and restore right away. Without an image, nobody can later prove how the attacker got in, what data they touched, or whether they are still inside. That answer drives decisions with real money attached: whether breach notification laws apply, what an insurer will pay for, and whether the same hole gets closed. NIST adds that evidence should be imaged and the original stored securely when it may be needed for prosecution or disciplinary action. A one-hour image before cleanup preserves options that cannot be recovered afterward.

How to Spot It / How DTS Handles It

Warning signs your evidence is at risk: a server already reinstalled "to be safe," a hacked website restored over itself, cloud snapshots deleted to save storage, or a laptop powered off before anyone copied its memory.

DTS captures volatile data first, images disks or takes provider snapshots, hashes every copy, and keeps the originals sealed while we analyze working copies. See our incident response service and why you should not wipe a hacked WordPress site yet.

Related Terms

Chain of custody: the record that keeps an image admissible and trusted.
Containment: isolate the system without destroying what the image needs.
Memory forensics: analysis of the volatile data captured first.
Do-not-wipe first response: the rule that protects evidence.
Backups and the 3-2-1 rule: how a backup differs from an evidence image.
Triage: the decision that says an incident needs evidence preserved.

Sources

NIST, SP 800-86, Guide to Integrating Forensic Techniques into Incident Response (2006): https://csrc.nist.gov/pubs/sp/800/86/final
CISA, Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise (December 13, 2020, closed): https://www.cisa.gov/news-events/directives/ed-21-01-mitigate-solarwinds-orion-code-compromise

Last updated October 14, 2026.