In digital forensics, imaging is the creation of a bit-for-bit copy of a device or storage medium. Unlike copying selected files, a forensic image can preserve deleted data, unallocated space, and other underlying information, depending on the acquisition method and device.
Investigators analyze the image rather than repeatedly handling the original evidence, helping reduce the risk of accidental changes. They document how it was acquired and use cryptographic hashes to check that the image remains unchanged. In real investigations, imaging supports repeatable analysis and a defensible chain of custody; write blockers and careful records can help protect source media during acquisition.