Forensic Hard Drive Image

• It is imperative to maintain the integrity of your computer during the forensic review process to ensure accurate results. According to Forensicon Inc., the best way to achieve this is to make a forensic image of your hard drive upon which to do the forensic review. A forensic image is an exact copy of what exists on the physical hard drive itself.
  
  Imaging can be accomplished by using commercial imaging software or free open source imaging programs. Keep in mind that a forensic image meeting the standards of evidence for legal matters takes skill and deep expertise within this arena. After creating the forensic image of your hard drive, you are ready to begin the forensic review of the image. Conducting the forensic review on the image as opposed to the hard drive itself allows it to remain intact, unaffected by the review process should future additional forensic reviews be required.
  
  

Using Forensic Review Software

• Use either commercial or open source computer forensic review software to analyze the hard drive image you previously created. Analyze the image for files that can include a history of documents residing on the computer, copies of emails sent or received by the computer, the Internet browsing history of the computer and any other activity in which the computer was engaged. Various forensic review software options entail different capabilities and levels of accuracy. Evidentiary-level forensic review procedures require a high level of digital forensics expertise.
  
  

Hire a Forensic Review Expert

• If you are conducting the computer forensic review just out of curiosity or for other non-legal reasons, then attempting it yourself presents little risk. However, if the forensic review is pursuant to litigation, then the use of an outside expert is highly advised. Directories of reputable digital investigation firms can be found online.