Fri Feb 13, 2015 9:45 am
I've always made at least 3 copies of a drive for forensics:
1. Exact clone with MD5 - stored in safe with original
2. Exact clone - no need for MD5, this drive is to play with, without having to worry about date and time stamps
3. Exact image file with MD5 - this is the working file that would be passed around between investigators and examined with enCase or other forensic software programs