Expert Witness Format (EWF)

Encrypted Waffle Format (EWF)

EnCase File Format (EFF)

Logical Volume Format (LVF)

Imaging is an exact bit-by-bit copy of an entire device & copying transfers only visible data

Imaging only copies the visible files & copying makes an exact duplicate of the entire device

Imaging copies only deleted files & copying copies every single bit perfectly

Imaging is when you take a selfie of your hard drive, and copying is like photocopying your documents

To analyze volatile memory (RAM) dumps for forensic artifacts

To permanently delete files from a hard drive

To extract running processes and other live system info

To magically reboot your computer into forensic mode with a single click

Display running processes in a hierarchical tree showing parent-child relationships

Hide any suspicious processes from the memory dump

Show active network connections related to running processes

Remove malware processes from the memory dump

image or dump file + output directory = report files

copied files + backup folder = compressed archive

live network traffic + decryption key = password list

hard drive + time machine = backups from the future

HashCalc

DataWiper

Hashbrowns

HashExplorer

To prevent modification of the original evidence

To speed up the imaging process

To make a backup copy automatically

To make sure the evidence stays in its original outfit

To password protect the acquired data

To encrypt the suspect’s device during collection

To prevent live response tools from using system resources

To make investigators feel like secret agents with passwords

True

False

Kinda true

Kinda false

True

False

Kinda true

Kinda false