## Disk Imaging & Acquisition

Copying a file (`Ctrl+C, Ctrl+V`) is NOT forensic acquisition. Copying only copies the *active* data. It ignores "Slack Space" and "Deleted Files".

### Forensic Image
A bit-by-bit clone of the drive. It copies every 0 and 1, including the empty space (where deleted files live).
*   **Formats**:
    *   **.dd (Raw)**: Pure dump.
    *   **.E01 (EnCase)**: The industry standard. Includes compression, password protection, and metadata (Case number, Investigator Name) inside the file header.

### Write Blockers
A hardware device that sits between the suspect drive and your computer.
*   **Function**: It physically cuts the "Write" wire. Data can flow *from* the suspect drive, but NOTHING can flow *to* it.
*   **Mandatory**: If you attach a Windows drive to your PC without a blocker, Windows will automatically mount it, update "Last Access" timestamps, create ".Trash" folders, and corrupt the evidence instantly.

### Tools
*   **FTK Imager**: Free, standard. can capture RAM and Disk.
*   **Guymager (Linux)**: fast open source imager.
*   **dd**: The classic Linux command. `dd if=/dev/sda of=/evidence/image.dd`.

### Verification
After imaging, the Imager will automatically hash the Source (Physical Drive) and the Destination (Image File). They must match.