People often think of tools as screwdriver, fork or knives when someone remarks of tool. However electronic devices, such as the cell phone, home computer or a laptop, personal digital assistant, and video games are also identified as tools. The existing internet and other electronic networks can also be referred to as tools. Despite the many tools available, each one of them has a specific purpose and thus should be used properly and in a safe manner. Morley (2008) asserts that computers can be used to either find victims of a kidnapping incidence as they can provide invaluable information about kidnapping cases. Forensic experts are often tasked with mining for information that could help link suspects to crimes as well as reveal information that may lead to rescue of kidnapped victims.
Forensic experts are increasing overwhelmed by the need to recover data or information from computers such as laptops to aid them in their work. Forensic experts are interested in carrying out research to determine the suspect's personality; activities, communications patterns, as well as motivation factors of criminal activities and to do so, forensic experts rely on retrieving digital data from suspect computers through digital imaging. Cross & Littlejohn (2008) define disk imaging as a process done to "make an exact copy of a disk" (p. 244).
Disk imaging is a special process that as the exact location for the file in a computer are preserved as well as the disk structure. During this process, forensic experts create a disk image as a result of copying the physical sectors of the source disk in a manner that preserves the exact location of data in the new image created. The created disk images can then be taken for further investigations. A disk image ensures that evidence is preserved from alteration while it is under scrutiny (Wiles, Cardwell, & Reyes, 2007).
How to make an image disk
Forensics-based imaging processes often relies on special computer connected to the target laptop or computer through any of the communications ports available, by which an entire copy of the target disk can imaged to another tape, disk, or other suitable electronic media. Sometimes, the disk is taken out from the target computer and mounted on special imaging machines. The success of this an imaging process depends on choice of tools that is determined by factors like price, operating system and interface types (Solomon, Broom & Barrett, 2005).
Tools for Imaging
A disk image can be created directly from the target computer or the target disk removed and mounted on a standalone imaging device. This depends on whether one can access the target laptop computer or not. If the compute cannot be powered on, then the disk has to be removed for standalone imaging else it will be image via a communication port. DIBS Portable Evidence Recovery Unit or Rapid Action imaging can be used when there is no need in removing the target disk from a suspect computer (Littlejohn & Cross, 2008). Disk imaging software can also be used to make the image of the laptop's disk as well as analyze the evidence. Here, SafeBack, ProDiscover or EnCase can be used to make an image of the target disk. EnCase for instance has a window based Graphical User Interface and can be used as it is easy to use. In case the laptops runs on windows operating system, Forensic Toolkit can be used to make multiple copies of the images in a quick and efficient (Solomon, Broom & Barrett, 2005).
Disk imaging is one of the most important innovations in the computer domain. This process is used to create exact copies of disk thus important in backing data. Forensic experts however use this process to make exact copies of suspect disk thus preserving their data and disk structure. The resulting digital image can serve as evidence in courts of law in situation of crimes and even kidnapping. Nevertheless, the success of disk imaging is hinged on the correct choice of imagining software such as Forensic Toolkit and Rapid Action Imaging tools.
