What is the difference between creating an image and copying a file?
An image is better than a clone or a copy because an image IS the target drive, just frozen in time. When a file is merely copied, windows will update the file creation date and other attributes of the file. A copy of a file, while useful for investigation may lack credibility in court. In fact a file presented alone is easy to discredit and dismiss. An entire image file of the computer will contain enough information to validate the individual file; it will preserve the context of the file which is also important. It can be very important WHERE on the drive a file is located to determine relevance, ownership or intent. When an investigation is conducted on an image file, the results of that investigation can be replicated by opposing counsels experts.
