Forensic disk images

Detects forensic disk-image acquisition records: image or acquisition-log wording with evidence/exhibit numbers, examiner, device serials, image file names and verification hashes. Topic wording alone is discovery-only.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated acquisition field (evidence/exhibit/case number, examiner, acquisition date, device serial, image path, source media) or an image artefact (MD5/SHA1/SHA256 hash, .E01/.AD1/.dd/.raw/.img/.aff file name)), and 85 needs two distinct structures plus independent forensic-handling (chain of custody, verification, imaging tool, seizure) evidence, so policies, blank forms and training text stay below 75.

Detection quality

Topic verified

Jurisdictions

global

Regulations

Privacy Act 1988 (Cth), GDPR

Frameworks

ISO 27001, NIST CSF

Data categories

security

Scope

wide

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:forensic\s+(?:disk\s+)?images?|disk\s+images?|bit[\s-]stream\s+(?:copy|image)|(?:dd|E01|raw)\s+image|acquisition\s+(?:log|report|summary))\b

Corroborative evidence keywords

chain of custody, hash verified, verification hash, FTK Imager, EnCase, Guymager, Tableau, bit-for-bit, seized, unallocated space

Proximity: 300 characters

Should match

• A forensic image of the laptop will be taken before it is reissued. — Discovery probe (65)
• Forensic image acquisition log Exhibit number: EX-0412 Examiner: J. Staffson — Medium-tier probe (75) - populated acquisition fields
• Forensic image acquisition log - matter 2026-0412 Exhibit number: EX-0412 Device serial: S4EVNX0N912345 Examiner: J. Staffson Image file: EX0412_laptop.E01 MD5: 9e107d9d372bb6826bd81d3542a419d6 - hash verified after acquisition with FTK Imager; chain of custody form signed. — High-tier probe (85) - several acquisition fields, image file and hash, custody context

Should not match

• unrelated generic text — No relevant phrase context
• placeholder value 12345 — Random text should not match
• Policy statement: forensic images must be stored on encrypted evidence drives with restricted access. — Policy text
• Forensic image acquisition log template Exhibit number: ________ Examiner: [insert] — Blank template
• Course module 5: creating a forensic image with FTK Imager - acquire to case1.E01 and verify the MD5. — Training framing

Known false positives

• IT staff use "disk image" for OS deployment images. Mitigation: Enforcement needs acquisition fields (evidence/exhibit/examiner/device serial) or forensic image artefacts; 85 also needs custody/verification context.

References

• Information Security Manual (ISM)
• Security of Critical Infrastructure Act 2018 (Cth)
• Data breach preparation and response (OAIC)
• APRA CPS 234 Information Security
• NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
• Privacy Act 1988 (Cth)