Physical and Logical Copies, RAM and Volatile Data
Where you are: Part II — The Technical Foundations · Lesson 2.4 · This lesson follows Chapter 2.4 of Dr. Al-Doori's IT Forensics Essentials: physical vs. logical copies, other devices and RAM.
What you'll be able to do
By the end of this lesson you will be able to choose the right kind of copy for a case, and explain what is lost when a computer is switched off.
- Tell a physical image from a logical copy, and choose between them.
- Explain what RAM holds and why it matters to an investigation.
- Use the order of volatility to decide what to collect first.
Physical Copy or Logical Copy?
The book distinguishes two very different ways to copy a drive.
- A physical copy (or physical image) is a bit-by-bit copy of the whole drive. It includes unallocated space, deleted files and fragments of anything previously stored that has not been overwritten, including the slack space you met in Lesson 2.3.
- A logical copy copies only the active data of a partition: the files and folders the file system currently knows about. Deleted files and free space are typically not included. It gives you roughly what you would see by browsing the drive.
Dr. Al-Doori's guidance is practical: every case is different, but if possible, a physical image is best practice, because it captures everything. A logical image is appropriate when the case only requires what is in the file system, or when there is not enough space to hold a full image. The choice depends on the needs of the individual case, and the examiner records why it was made.
| Physical image | Logical copy | |
|---|---|---|
| Copies | Every bit of the drive or partition | Active files and folders only |
| Deleted files, slack, free space | Included | Usually not included |
| Size and time | Large and slow | Smaller and faster |
| Typical use | Full forensic examination | Targeted collection, e-discovery, limited scope |
Forensic images are usually saved in standard formats. A raw image (often called a "dd" image after the Unix command) is a plain sequence of bytes. An E01 image (the EnCase evidence format) stores the data with built-in metadata and hash values. Both can be verified with hashes, as in Lesson 2.1.
RAM: The Evidence That Disappears
Random access memory (RAM) is the computer's working memory, where the processor keeps whatever it is using right now. The book stresses its defining property: RAM is volatile, meaning it is wiped when the computer is switched off.
While the machine is running, RAM can hold evidence that exists nowhere else:
- Unsaved work, such as a document being typed or a message not yet sent.
- Settings and the current state of programs.
- Access to open, password-protected files, already unlocked for the user.
- Running programs and network connections, including malware that never writes itself to disk.
- Encryption keys for drives and files that are currently unlocked, as Chapter 3 notes.
Some RAM contents can be recovered if the machine is found switched on. And some remnants survive on disk: the page file is where the system swaps information in and out of memory, so fragments of RAM can be found there even after shutdown. Windows' hibernation file plays a similar role when a computer hibernates.
The Order of Volatility
If some evidence disappears faster than other evidence, the sensible rule is to collect the most volatile first. The IETF's evidence-collection guidelines (RFC 3227) give an example order for a typical system, from most to least volatile:
- Processor registers and cache
- Routing table, ARP cache, process table, kernel statistics and memory
- Temporary file systems
- Disk
- Remote logging and monitoring data relevant to the system
- Physical configuration and network topology
- Archival media, such as backups
In practice that means capturing memory and the live state of a running system before imaging its disk, and the disk before backups. Lesson 3.4 shows how live acquisition is done.
Real-World Example
Imagine (a fictional scenario) investigators executing a warrant at an office where they find a laptop running, with a messaging app open and an encrypted drive unlocked. The investigator photographs the screen, then uses a memory-capture tool from a prepared USB drive to save the laptop's RAM to external storage, recording the time, the tool and a hash of the output. Only then does she decide, following the agreed procedure, how to shut the laptop down.
Later, analysis of the memory capture shows the messaging app's recent conversation, a connection to a remote server that does not appear in any file on disk, and the information needed to open the encrypted drive. Had the laptop been switched off at the door, all three would have been lost.
From the Book to 2026
What the book teaches. A physical image captures everything and is best practice where possible; a logical image is acceptable when the case or space requires it. RAM is volatile, holds unsaved and open data, and can partly be recovered from a running machine and from the page file.
Why it made sense. For a desktop or laptop with an unencrypted hard drive, a full physical image is the gold standard, and that remains true.
What has changed. Two developments make the choice harder and RAM more important. First, encryption by default: Microsoft documents that device encryption turns on automatically on many Windows 11 devices, and phones are encrypted by default. A physical image of an encrypted drive contains only encrypted data unless the key is available, so capturing memory or a logical copy while the system is unlocked can be the only way to get readable evidence. Second, scale and location: servers hold many terabytes, and much evidence now lives in cloud services that cannot be physically imaged at all. Targeted logical collection is therefore far more common than when the book's advice was first framed.
What to do now. Default to a physical image, but decide case by case and record your reasoning. When a device is running, think of memory first and follow the order of volatility. Expect logical and live collection for encrypted, very large or cloud-based sources.
What Would You Do?
You arrive at a scene to collect a desktop computer. It is switched on, and the screen shows the desktop with no programs open. Your colleague wants to "pull the plug, it's the only way to be safe". What questions would you ask before deciding? Think about it, then compare with the model answer in the note below.
Knowledge Check
Which copy would include a deleted file whose space has not yet been overwritten?
According to RFC 3227's order of volatility, which should normally be collected first from a running system?
A drive is fully encrypted, and the computer is found running and unlocked. Why might investigators capture memory before shutting it down?
Answers explained
- Question 1: a. A physical image copies every bit, including unallocated space where deleted data may remain. A logical copy (b) usually includes active files only.
- Question 2: c. Memory and the live system state are near the top of RFC 3227's list. The disk (b) comes later, and backups (a) and topology (d) later still.
- Question 3: a. The point is the key and unlocked data in RAM. Encrypted drives can be imaged (c), but the image is unreadable without the key, and shutting down does not delete the files (d).
On "What Would You Do?": Ask: Is the disk encrypted, and is it currently unlocked? Are there signs of remote access, running processes or network activity that only memory would show? What does the authority and procedure for this case say, and do you have a trained person and a validated tool to capture memory? Is there a risk that leaving it on lets someone wipe it remotely? If memory may matter, capture it first, record everything, then shut down according to procedure.
Key Takeaways
- A physical image copies every bit, including deleted data and slack. A logical copy takes active files only. Prefer physical, decide case by case and record why.
- RAM is volatile. It can hold unsaved work, open protected files, running malware, network connections and encryption keys.
- Collect from most to least volatile (RFC 3227): memory and live state before disk, disk before backups.
- Encryption by default, huge drives and cloud storage make memory capture and targeted logical collection more important today.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapters 2.4 and 3.1
- IETF — RFC 3227: Guidelines for Evidence Collection and Archiving (Section 2.1, Order of Volatility)
- NIST — SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
- Microsoft Learn — BitLocker overview: device encryption
- NIST — IR 8006: NIST Cloud Computing Forensic Science Challenges