A
forensic copy is a bit-for-bit duplicate of storage media — including deleted files and unallocated space. Hash values verify the copy matches the original exactly.
Always work on forensic copies — never on original evidence. Tool: dd (Linux), FTK Imager. Hash before and after copying (MD5 + SHA-256). The original must remain untouched for legal admissibility.