Skip to content

Understanding Disk Acquisition

Disk acquisition creates a controlled representation of storage media so analysis can proceed without repeatedly interacting with the original source.

What you will learn

By the end, you should be able to distinguish physical and logical acquisition, explain integrity verification, and plan a documented imaging workflow.

Disk acquisition

Core concept

A disk acquisition copies selected storage content into an evidence file or controlled destination. A physical image aims to include addressable sectors, including unallocated space; a logical acquisition copies selected files or volumes visible through the operating system or acquisition tool.

Source mediaImage formatHashesLogsChain of custody

Keep in mind: A hash supports integrity comparison; it does not by itself prove who collected the evidence, whether the method was appropriate, or whether the source was complete.

01Physical imageA sector oriented representation of storage media02Logical acquisitionSelected files or data exposed through a file system03Write blockerA control intended to prevent writes to source media

Acquisition choices

Physical acquisitionUse when allocated and unallocated storage may be relevant
Logical acquisitionUse for selected accessible files or constrained collection
Live acquisitionUse when encryption or availability makes shutdown unsuitable
Offline acquisitionUse to reduce source system activity where practical

Why it matters

Protect the source

Analysis can be repeated from a controlled image while original media remains preserved.

Retain storage context

Physical imaging may preserve partitions, metadata, deleted records, and unallocated areas.

Verify integrity

Recorded hashes allow later comparisons between the acquired image and working copies.

Support review

Acquisition notes allow another examiner to understand the source, method, settings, and limitations.

Acquisition workflow

  1. PlanRecord authority, source identity, capacity, encryption, destination, and acquisition objective.
  2. ProtectUse an appropriate write protection method and document unavoidable live system changes.
  3. AcquireSelect the image type, format, segmentation, and destination, then monitor errors.
  4. VerifyCalculate and compare supported integrity hashes and confirm expected image size and structure.
  5. PreserveLabel and store the image, logs, hashes, notes, and chain of custody information.

Practice scenario

Take the role of the acquisition analyst in a suspected data theft case. Preserve a USB so the next analyst can examine possible deleted file evidence. Use the workbench to connect the source, plan and create an image, check its copies and save a handover. You can try different settings and recover from mistakes without touching a real disk.

CASE SUSA-DA031 · EVIDENCE USB-01

Preserve the USB before you investigate

A company reports that project files disappeared from a USB after a suspected data theft. Your team lead has approved an image of the whole USB. Your job is to preserve it so another analyst can look for deleted files without changing the original.

Evidence labelUSB-01Serial: SUSA-USB-06464 GB · disconnected · no encryption reported

Browser exercise · All devices, disk sizes and results are examples. No real disk is read or changed. You will make an acquisition plan, verify copies and download case notes.

  1. 1Protect
  2. 2Plan
  3. 3Image
  4. 4Verify
  5. 5Hand over
Step 1 of 5

Match and protect the source

Match the USB serial number to the evidence label, then choose a write blocked connection.

Set up the evidence connection

1. Select the device listed on the evidence label

No device selected. Match the serial number, not just the drive number.

A write blocker lets the imaging computer read the USB while preventing it from writing to it.

Check the device and connection before continuing.

Source USBNot selected
Write blockerNot connected
Imaging computerRead the source; save elsewhere

Start by matching the source to the evidence label.

Quality checklist

Make the result reproducible

  1. 1IdentifyRecord media identifiers, condition, interfaces, and capacity.
  2. 2ControlDocument write protection and the acquisition environment.
  3. 3VerifyRecord hashes, tool logs, errors, and image properties.
  4. 4PreserveStore originals and create verified working copies.
!Plan for acquisition friction
Large mediaBad sectorsEncryptionRAIDInsufficient storageUnstable interfaces

Document read errors, retries, skipped areas, and any difference between the intended and completed acquisition.

Choose a tool

Image and preview

FTK Imager

Create forensic images, preview supported sources, export selected files, and retain acquisition hashes and logs for review.

Open the FTK Imager learning journey

Continue learning