"Before starting any forensic analysis, it is important to
create a copy of the storage medium you will be investigating,
either as a 1:1 copy or as an image or a collection of images. You
can copy the medium as a raw image (with dd) or use a format such
as Expert Witness Format (EWF)."