# Disk Acquisition & Write Blockers

Disk acquisition is the process of creating an exact, bit-for-bit replica of a storage medium (Hard Drive, SSD, USB, SD Card). We never analyze the original evidence directly; we analyze the replica to preserve the original.

## Logical vs. Physical Acquisition
There are two main types of acquisitions:

### 1. Logical Acquisition
A logical acquisition relies on the Operating System to read the files and copy them. It copies only the files the OS can see. 
*   **Pros:** Fast. Good for targeted collections (e.g., "Just copy the user's Documents folder").
*   **Cons:** It misses deleted files, hidden partitions, and slack space. 

### 2. Physical (Bit-Stream) Acquisition
A physical image reads the raw 1s and 0s directly from the physical disk hardware, ignoring the OS entirely. 
*   **Pros:** Captures absolutely everything, including deleted files, unallocated space, and hidden partitions. This is the gold standard for full investigations.
*   **Cons:** Very slow. A 2TB drive requires a 2TB image file, even if the drive is 90% empty.

## Write Blockers
If you plug a suspect's Windows hard drive into your forensic laptop just to "take a look", your Windows OS will aggressively mount the drive. In the background, it will update recycle bin files, change access timestamps, and create thumbnail caches. The evidence is now legally compromised.

To prevent this, we use **Write Blockers**. 
A write blocker is a device that intercepts all commands headed to the suspect drive. It allows `READ` commands to pass through but drops and blocks any `WRITE` commands.

*   **Hardware Write Blockers:** Physical devices (like Tableau or WiebeTech) that you physically plug the suspect drive into. They are considered the most reliable method.
*   **Software Write Blockers:** Software utilities or registry keys (like Linux mounting a drive as `read-only`). Less foolproof than hardware, but necessary for laptops where the SSD is soldered to the motherboard and cannot be physically removed.

## Forensic Image Formats
When you create the image, you don't just copy the files into a zip folder. You use specialized forensic formats:
1.  **Raw (DD):** The simplest format. Just a massive file containing the exact 1s and 0s of the disk. No compression, no built-in metadata.
2.  **EnCase (E01):** The industry standard. Combines the raw bitstream with compression, built-in hashing, and metadata (investigator name, case number) all wrapped into a single secure file.
3.  **AFF4:** Advanced Forensic Format version 4. A newer, open-source format designed for high speed and massive datasets.