Data Acquisition
"Once we have established the nature of the investigation, we will begin the acquisition of the data. For this we need to create a duplicate of the media, typically by using a write blocker. This provides our specialists with a snapshot or mirror image of the data contained on the media, and is a perfect copy of the drive. The imaging process is non-destructive to the data, which ensures the integrity of the investigation"