in computer forensics imaging is the process of duplicating the data of an entire hard drive

Computer imaging is the process of duplicating the data of an entire hard drive. Imaging has many uses. For example, many network and systems administrators use imaging to deploy a consistent operating system installation across a series of computer with the same hardware. This saves the administrator time and effort by not having to load each computer by hand.

However, in the realm of computer forensics, disk imaging is used to make an exact copy of a drive so to not “tamper” or “damage” the original evidence.

In computer forensics what are the steps to creating an image of a disk?

What security checks should be performed to ensure an exact copy is made?

What are some reasons disk imaging is useful in computer forensics?