actual condition of forensics in your country

Not sure what you mean by "physical copy (not imaging)", but as above, the copy is always a image of the complete hard drive bit for bit (encase physical image etc - not logical), using a write-blocker where possible, or if not then using a boot cd and network aquisition or suchlike.

hi Rich,

I'm Japanese, so as Pied.
I'm also interedted in what pied pointing out.

We usually use Solo3(of ICS) and need new two HDD.
Step1 copy physical raw data from suspect HDD to evidence HDD(1) with Solo3.
Step2 make image data from evidence HDD(1) to another HDD(2) with Solo3.
Step3 connect HDD(2) with examiner PC.

But I have never read that process here. 😯

In your process, where do you save imege data? In examiner's PC or removable HDD connected with examiner's PC?
And do you always make image data from suspect HDD to there directly, whichever criminal case or that of civil?

could you tell us,Japanese, the actual way to preserve evidence.

thanks

Well over here, ACPO guidlines are such that you want to get a copy of the information without making any changes if possible to the original data, noting down whatever you do, so the process is repeatable at a later date by anyone such as an opposing expert.
The location you store your image shouldnt really be an issue, other than the fact it needs to be reliable, so ideally a mirrored raid - portable or network server. When copying images around its always a good idea to hash them before/after too - as images have been known to corrupt when copying across networks. One you've acquired the image, its really personal preference how you examine it, as long as you document it, the evidence is preserved already via write blocker etc.
In general i would expect most people are probably storing their image files on a big raided file server, and perhaps/probably working off local copies off those image files during analysis.
Is this what you mean?

Hi Pied & Rich,

Hello from India.

In India we use Voom, ICS & Logicube for creating images or forensic clones. We use Forensic Write block bridges (www.tableau.com) while using software to create images.

I had heard that AccessData www.accessdata.com offers Japanese language forensic tools - you might want to visit their Japanese distributors (UBIC) site http//www.ubic.co.jp
for more info.

Hope this helps

Samir Datt
www.ForensicsGuru.com