After this process, we will get a mirror image of the desired disk. Thehash value must be calculated for both the image and the original disk.
Comparethe values to make sure that this process is done properly. This tool cancalculate the required Hash.Write protection device:One of the most important things to consider during the investigationprocess is to protect the digital directory by using the write blocker on the harddisk. You must prevent writing to the hard drive immediately before you startcreating the mirror image.Many operating systems write to the hard drive periodically so you mustuse a device to prevent writing on the hard drive. There are several types ofwrite-blocking devices that vary by type of connection and can be SATA to SATAor USB to SATA.
The following table contains the names and types of the most commonlyused writing block devices: Some of the important things we should care about to protect the digitalmanual are the prevention of static electric fields because they can damage thedigital manual and are done using a special bag specifically designed toprevent static electric fields that are used to save digital evidence. Thedigital forensic laboratory must be isolated and not allowed to communicatewith the external medium. This is done by using a network of metal bars thatprevent the electromagnetic field to prevent the devices from sending orreceiving data from a distance over the wireless network or the mobile network. When working with mobile devices it is necessary to isolate the devicefrom the network, it is possible to delete data from a distance (some mobiledevices provide remote data deletion in the event of loss or theft of mobile)It is also possible to connect to the device over the wireless network or overthe mobile network and modification Of the data and the device may be infectedwith malicious software that sends information to an external party over thenetwork so it is necessary to isolate the device from the network.