After acquiring and preserving the evidence, evidence should be analyzed. Forensic tools can usually take a partition or a disk image as input to work on images in live systems.

Dr. Afsaneh Javadi, Karan Jindal

Data acquisition  is the first step computer investigation process model. It is the process of making a forensic image from computer media such as a hard drive, thumb drive, CDROM, removable hard drives, thumb drives, servers and other media that stores electronic data including gaming consoles and other devices.