I am writing a report on my recent acquisition of several computers. Being this is my first report, I am not 100% sure what the cf industry standard name is for the drive I saved all of the acquired images (E01) files. I was thinking acquisition drive, target drive, storage drive, or something similar.
Thanks for your help.
Good morning,
I generally use "target drive". "The suspect drive #123456 was imaged to the target drive 654321" (or just "to drive 654321").
-David
I've seen various terms used, such as "source media" or "subject media" or "suspect drive" and "target drive" or "evidence drive" or "forensic working copy" for the destination media, so I wouldn't be comfortable saying that there is a standard.
What is important is that you pick terms that are descriptive without being judgmental (e.g. "the perp's drive" is ill-advised), you use the terms consistently throughout your report and, when in doubt, include a glossary with your report which defines any terms that you use that have a special or precise meaning in your report.
Remember that if there is litigation involved, your report may be the subject of your deposition and anything that you write could be fair game.
There are a couple of good forensic glossaries floating around where the authors have granted permission for their re-use in reporting. Using one of these to guide your selection of terminology can be helpful in making your report appear unambiguous and professional.