Once you know how evidence should be handled, the next question is how to capture it without changing it. Evidence acquisition is the step where data is copied from a device into a form you can safely examine, and getting it wrong can make everything that follows unreliable.
You'll learn why investigators use write blockers to stop a workstation from altering a suspect drive, how a forensic image differs from an ordinary copy, and how tools like FTK Imager create images in common formats such as raw (dd) and E01. You'll also see how cryptographic hashes such as MD5 and SHA-256 prove that an image matches the original.
Next up is File Systems & Data Recovery, where you'll start examining what's inside the images you've just learned to create.
An introduction to external write blockers and why they are used to prevent any changes to a suspect disk during data acquisition.
How to create forensic disk images on Linux, covering write blockers, image formats, and legal best practices.
How to create a multi-part disk image in FTK Imager and verify it with hash values, so you can show the image is intact.
Using FTK Imager to create a physical disk image of a suspect drive connected to a forensic workstation.