Acquisition: Making a Forensic Copy
Acquisition is the process of creating a verified forensic copy of a device or storage medium. It involves connecting the original device through a write blocker — hardware that prevents any data from being written to the original — and creating a bit-for-bit copy that is mathematically verified against the original using hash values.
What acquisition does: creates an exact, verified duplicate of the original that can be examined without risk to the original evidence. Documents the state of the evidence at the time of collection.
What acquisition does not do: analyze, interpret, or answer any evidentiary question. Acquisition produces a forensic copy. Nothing more.
Examination: Analyzing the Copy
Examination is the analysis of the forensic copy — navigating the file system, recovering deleted content, reconstructing user activity, analyzing communications, and producing findings that address the specific questions posed by counsel.
Examination is where the evidentiary work happens. It is also where most of the time is spent, and where the scope of your questions directly determines the cost.
Why the Distinction Matters in Practice
Some matters require both. You need a forensically sound copy, and you need it analyzed. But others may require only one phase — or may already have one phase completed by the time you engage an examiner.
If opposing counsel has already produced a forensic image under court order, and you are engaging an expert to review findings rather than conduct a new examination, you may need examination work only — not acquisition. If you are preserving evidence early in litigation before any questions are fully formed, you may need acquisition now and examination later.
Budgeting Accurately
Because acquisition and examination are separate phases with separate costs, a forensic engagement budget should address each phase separately. Acquisition cost is largely determined by the size and number of devices. Examination cost is largely determined by the scope of questions and the volume of responsive data.
A written scope of work will specify what phase or phases are included, what devices or data are covered, and what questions the examination is designed to answer. Review that scope carefully before approving it.