Logical/Partitioned Acquisition (Dynamic)"), not the entire physical disk. Useful when a full physical copy is impractical or when only specific partitions are relevant.
- Dynamic (live) acquisitions may involve logical acquisitions rather than full physical copies, potentially leaving some data on unmounted partitions inaccessible until remounted in a controlled environment.
- Static (physical offline) acquisition yields the entire physical rock (the drive) and is typically preferred for court-admissible, chain-of-custody-compliant images.
- Evidence collection tool and format reference
- Primary tool discussed: EnCase (forensic software suite) and the proprietary evidence container format often used: $$E01$$ (commonly pronounced E-01 or
