Typically, a binary image of a hard drive is immediately created when a forensic examination begins. This is done to stem the possibility of the hard drive contents being altered during examination.

Digital images are made up of pixels. Each pixel is represented by a binary number. Consider a simple black-and-white image. If 0 is black (or on) and 1 is white (or off), then a simple black-and ...