Computer forensics laboratory
The exact physical copy of the evidence is called bit-stream image, forensic duplicate or forensic image and is done by removing the hard disk from the source computer and attaching it to the investigator's forensic machine with the following security measures: using a write-blocker to ensure that no data is written to it in the β