306 ◾ Information Security Management Handbook
Imaging is a term that means to copy all allocated and unallocated parts of storage. Solomon,
Barett, and Broom, three authorities on digital forensics, also refer to the image as a forensic
duplicate. e forensic duplicate starts at byte zero and goes to the last byte of the storage device.
e duplicate or image contains parts of files, parts of sessions, and many pieces of important
forensic evidence that can help the CCE get a clearer understanding of the case and create a
report. An image is different than a backup because a backup only includes files that are pres-
ently listed in the file allocation table. A backup does not include existing files that were marked
for deletion.
Many law offices t ...