Forensic Image
What is Forensic Image?
A bit-for-bit copy of a storage device or partition created for digital forensic analysis while preserving the integrity of the original evidence.
Terms that appear alongside forensic image
Each of these is named in at least one of the same controls as forensic image. The number is how many controls name both.
- evidence preservation 2 shared controls
- forensic readiness 2 shared controls
- chain of custody 2 shared controls
Frameworks that govern forensic image
What the standards actually require on forensic image
Requirements naming forensic image across 3 standards, quoted from the control text.
Create forensic images and backups of affected systems before performing further changes
PICERL-C2 · System Backup →UR E27 requires equipment manufacturers to deliver CBS with logging + forensic readiness capabilities aligned with IEC 62443-4-2 CR 2.8-2.12 (Auditable events) + FR 6 (Timely Response to Events).
IACS-UR-E27-Logging-Forensics-EventCapture · IACS UR E27 - Equipment Logging + Forensic Readiness + Event Capture + Tamper Detection →Incident Response capability is critical per FSA Cybersecurity Guidelines. (1) Incident Response Plan: (a) Documented IR Plan + per FFIEC IT Examination Handbook reference; (b) ISO/IEC 27035 Information Security Incident Management;
JP-FSA-CYB-Incident-Response-Playbooks-Containment-Eradication-Recovery-Post-Mortem-Tabletop-CSIRT · Japan FSA Cybersecurity Incident Response + Playbooks + Containment + Eradication + Recovery + Post-Mortem + Tabletop Exercises + CSIRT + FSA Notification + Customer Communication + Forensics + Lessons Learned →Questions people ask about forensic image
What is Forensic Image?
Why is Forensic Image important for compliance?
Which compliance frameworks address Forensic Image?
Where can I learn more about Forensic Image?
See how Forensic Image applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.