{"id":1692,"date":"2017-06-14T15:51:34","date_gmt":"2017-06-14T13:51:34","guid":{"rendered":"http:\/\/blog.atola.com\/?p=1692"},"modified":"2017-06-14T15:51:34","modified_gmt":"2017-06-14T13:51:34","slug":"creating-a-logical-image","status":"publish","type":"post","link":"https:\/\/atola.com\/blog\/creating-a-logical-image\/","title":{"rendered":"Creating a logical image of a source drive"},"content":{"rendered":"<p>While physical imaging involves sector-for-sector copying the whole evidence drive from the first LBA to the last one, logical acquisition implies bit-for-bit copying of the file structure.<\/p>\n<p>Logical acquisition is handy, when time is limited and you need to quickly start working with the file structure. At the same time, logical image does not include remaining fragments of previously deleted files, which makes this imaging method incomplete. On top of that, hash values of the source and the target will not be identical. Therefore, for profound investigation, it is still preferable to use a physical image.<\/p>\n<p>This guide will show how Atola Insight Forensic\u2019s flexible imaging functionality enables users to perform selective logical imaging.<\/p>\n<p>In the <em>Imaging<\/em> category of the left-side menu there is <em>I want to image<\/em> drop-down menu, where you can select <em>All sectors with data<\/em> or <em>All sectors with metadata\u00a0<\/em>options.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-1693\" src=\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png\" alt=\"\" width=\"822\" height=\"713\" srcset=\"https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png 822w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data-150x130.png 150w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data-300x260.png 300w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data-768x666.png 768w\" sizes=\"(max-width: 822px) 100vw, 822px\" \/><\/p>\n<p>When you choose <em>All sectors with data<\/em>, you can image the whole system structure of the drive including folders and files, while omitting the areas with no data or fragments of previously deleted files.<\/p>\n<p>By going for <em>All sectors with metadata<\/em> option you can image the system structure without data within its files (e.g. MFT in NTFS) for file browsing and selecting specific files to be imaged in full. For more information on this please watch this video guide: <a href=\"https:\/\/www.youtube.com\/watch?v=zXSHWbkPXDQ\">Benefits of Imaging Metadata<\/a>.<\/p>\n<p>When you select either of these two options, imaging log adds a message about the partitions Insight has been able to find.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-1694\" src=\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/2-Imaging-Results.png\" alt=\"\" width=\"879\" height=\"739\" srcset=\"https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/2-Imaging-Results.png 879w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/2-Imaging-Results-150x126.png 150w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/2-Imaging-Results-300x252.png 300w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/2-Imaging-Results-768x646.png 768w\" sizes=\"(max-width: 879px) 100vw, 879px\" \/><\/p>\n<p>Once imaging is complete, you can view the structure of the logical image you have obtained by clicking <em>Analyze target image<\/em>.<\/p>\n<p>This will open the <em>Target<\/em> port.<\/p>\n<ol>\n<li>Click\u00a0<em>Scan partitions<\/em> button<\/li>\n<li>Select any of the imaged partitions you want to<\/li>\n<li>Click\u00a0<em>Open partition<\/em> button<\/li>\n<\/ol>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-1695\" src=\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/3-Target-Partitions.png\" alt=\"\" width=\"955\" height=\"497\" srcset=\"https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/3-Target-Partitions.png 955w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/3-Target-Partitions-150x78.png 150w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/3-Target-Partitions-300x156.png 300w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/3-Target-Partitions-768x400.png 768w\" sizes=\"(max-width: 955px) 100vw, 955px\" \/><\/p>\n<p>In our example, we have imaged all sectors with data, and the partition we open contains the file structure and files, which we can explore, open and analyze.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-large wp-image-1696\" src=\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/4-Partition-Root-Directory-1024x639.png\" alt=\"\" width=\"1024\" height=\"639\" srcset=\"https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/4-Partition-Root-Directory-1024x639.png 1024w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/4-Partition-Root-Directory-150x94.png 150w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/4-Partition-Root-Directory-300x187.png 300w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/4-Partition-Root-Directory-768x479.png 768w, https:\/\/atola.com\/blog\/wp-content\/uploads\/2017\/04\/4-Partition-Root-Directory.png 1192w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>While physical imaging involves sector-for-sector copying the whole evidence drive from the first LBA to the last one, logical acquisition implies bit-for-bit copying of the file structure. Logical acquisition is handy, when time is limited and you need to quickly start working with the file structure. At the same time, [&hellip;]<\/p>\n","protected":false},"author":8,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Creating a logical image of a source drive<\/title>\n<meta name=\"description\" content=\"This guide will show how Atola Insight Forensic\u2019s sophisticated imaging functionality enables users to perform selective logical imaging.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/atola.com\/blog\/creating-a-logical-image\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Creating a logical image of a source drive\" \/>\n<meta property=\"og:description\" content=\"This guide will show how Atola Insight Forensic\u2019s sophisticated imaging functionality enables users to perform selective logical imaging.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.atola.com\/creating-a-logical-image\/\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/AtolaTechnology\" \/>\n<meta property=\"article:published_time\" content=\"2017-06-14T13:51:34+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png\" \/>\n<meta name=\"author\" content=\"Yulia Samoteykina\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@atola_insight\" \/>\n<meta name=\"twitter:site\" content=\"@atola_insight\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Yulia Samoteykina\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/\"},\"author\":{\"name\":\"Yulia Samoteykina\",\"@id\":\"https:\/\/atola.com\/blog\/#\/schema\/person\/f5faf6ed7d19bbc113d3d54fd30b6820\"},\"headline\":\"Creating a logical image of a source drive\",\"datePublished\":\"2017-06-14T13:51:34+00:00\",\"dateModified\":\"2017-06-14T13:51:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/\"},\"wordCount\":331,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/atola.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png\",\"articleSection\":[\"Atola Insight Forensic\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/blog.atola.com\/creating-a-logical-image\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/\",\"url\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/\",\"name\":\"Creating a logical image of a source drive\",\"isPartOf\":{\"@id\":\"https:\/\/atola.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png\",\"datePublished\":\"2017-06-14T13:51:34+00:00\",\"dateModified\":\"2017-06-14T13:51:34+00:00\",\"description\":\"This guide will show how Atola Insight Forensic\u2019s sophisticated imaging functionality enables users to perform selective logical imaging.\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.atola.com\/creating-a-logical-image\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/#primaryimage\",\"url\":\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png\",\"contentUrl\":\"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.atola.com\/creating-a-logical-image\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/atola.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Creating a logical image of a source drive\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/atola.com\/blog\/#website\",\"url\":\"https:\/\/atola.com\/blog\/\",\"name\":\"Atola Blog\",\"description\":\"Atola Blog\",\"publisher\":{\"@id\":\"https:\/\/atola.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/atola.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/atola.com\/blog\/#organization\",\"name\":\"Atola Technology\",\"url\":\"https:\/\/atola.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/atola.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/atola.com\/blog\/wp-content\/uploads\/2026\/04\/Atola_technology1.jpg\",\"contentUrl\":\"https:\/\/atola.com\/blog\/wp-content\/uploads\/2026\/04\/Atola_technology1.jpg\",\"width\":840,\"height\":689,\"caption\":\"Atola Technology\"},\"image\":{\"@id\":\"https:\/\/atola.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/AtolaTechnology\",\"https:\/\/x.com\/atola_insight\",\"https:\/\/ua.linkedin.com\/company\/atola-technology\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/atola.com\/blog\/#\/schema\/person\/f5faf6ed7d19bbc113d3d54fd30b6820\",\"name\":\"Yulia Samoteykina\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/atola.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/ae740994d03c863e03a5172c3c242ddb?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/ae740994d03c863e03a5172c3c242ddb?s=96&d=identicon&r=g\",\"caption\":\"Yulia Samoteykina\"},\"description\":\"Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.\",\"url\":\"https:\/\/atola.com\/blog\/author\/yulia-samoteykinaatola-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Creating a logical image of a source drive","description":"This guide will show how Atola Insight Forensic\u2019s sophisticated imaging functionality enables users to perform selective logical imaging.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/atola.com\/blog\/creating-a-logical-image\/","og_locale":"en_US","og_type":"article","og_title":"Creating a logical image of a source drive","og_description":"This guide will show how Atola Insight Forensic\u2019s sophisticated imaging functionality enables users to perform selective logical imaging.","og_url":"https:\/\/blog.atola.com\/creating-a-logical-image\/","article_publisher":"https:\/\/www.facebook.com\/AtolaTechnology","article_published_time":"2017-06-14T13:51:34+00:00","og_image":[{"url":"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png"}],"author":"Yulia Samoteykina","twitter_card":"summary_large_image","twitter_creator":"@atola_insight","twitter_site":"@atola_insight","twitter_misc":{"Written by":"Yulia Samoteykina","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.atola.com\/creating-a-logical-image\/#article","isPartOf":{"@id":"https:\/\/blog.atola.com\/creating-a-logical-image\/"},"author":{"name":"Yulia Samoteykina","@id":"https:\/\/atola.com\/blog\/#\/schema\/person\/f5faf6ed7d19bbc113d3d54fd30b6820"},"headline":"Creating a logical image of a source drive","datePublished":"2017-06-14T13:51:34+00:00","dateModified":"2017-06-14T13:51:34+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.atola.com\/creating-a-logical-image\/"},"wordCount":331,"commentCount":0,"publisher":{"@id":"https:\/\/atola.com\/blog\/#organization"},"image":{"@id":"https:\/\/blog.atola.com\/creating-a-logical-image\/#primaryimage"},"thumbnailUrl":"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png","articleSection":["Atola Insight Forensic"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blog.atola.com\/creating-a-logical-image\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blog.atola.com\/creating-a-logical-image\/","url":"https:\/\/blog.atola.com\/creating-a-logical-image\/","name":"Creating a logical image of a source drive","isPartOf":{"@id":"https:\/\/atola.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.atola.com\/creating-a-logical-image\/#primaryimage"},"image":{"@id":"https:\/\/blog.atola.com\/creating-a-logical-image\/#primaryimage"},"thumbnailUrl":"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png","datePublished":"2017-06-14T13:51:34+00:00","dateModified":"2017-06-14T13:51:34+00:00","description":"This guide will show how Atola Insight Forensic\u2019s sophisticated imaging functionality enables users to perform selective logical imaging.","breadcrumb":{"@id":"https:\/\/blog.atola.com\/creating-a-logical-image\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.atola.com\/creating-a-logical-image\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.atola.com\/creating-a-logical-image\/#primaryimage","url":"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png","contentUrl":"http:\/\/blog.atola.com\/wp-content\/uploads\/2017\/04\/1-all-sectors-with-data.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.atola.com\/creating-a-logical-image\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/atola.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Creating a logical image of a source drive"}]},{"@type":"WebSite","@id":"https:\/\/atola.com\/blog\/#website","url":"https:\/\/atola.com\/blog\/","name":"Atola Blog","description":"Atola Blog","publisher":{"@id":"https:\/\/atola.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/atola.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/atola.com\/blog\/#organization","name":"Atola Technology","url":"https:\/\/atola.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/atola.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/atola.com\/blog\/wp-content\/uploads\/2026\/04\/Atola_technology1.jpg","contentUrl":"https:\/\/atola.com\/blog\/wp-content\/uploads\/2026\/04\/Atola_technology1.jpg","width":840,"height":689,"caption":"Atola Technology"},"image":{"@id":"https:\/\/atola.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/AtolaTechnology","https:\/\/x.com\/atola_insight","https:\/\/ua.linkedin.com\/company\/atola-technology"]},{"@type":"Person","@id":"https:\/\/atola.com\/blog\/#\/schema\/person\/f5faf6ed7d19bbc113d3d54fd30b6820","name":"Yulia Samoteykina","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/atola.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/ae740994d03c863e03a5172c3c242ddb?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/ae740994d03c863e03a5172c3c242ddb?s=96&d=identicon&r=g","caption":"Yulia Samoteykina"},"description":"Director of Marketing Yulia believes that with a product that is exceptionally good at solving tasks of forensic experts, marketing is about explaining its capabilities to the users. Yulia regularly represents Atola at DFIR events, holds free workshops and webinars about Atola imagers functionality and advocates on the users' behalf to ensure that Atola keeps on adding value and raising the bar for the industry.","url":"https:\/\/atola.com\/blog\/author\/yulia-samoteykinaatola-com\/"}]}},"_links":{"self":[{"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/posts\/1692"}],"collection":[{"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/comments?post=1692"}],"version-history":[{"count":0,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/posts\/1692\/revisions"}],"wp:attachment":[{"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/media?parent=1692"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/categories?post=1692"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/atola.com\/blog\/wp-json\/wp\/v2\/tags?post=1692"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}