What is a forensic image, and when do we need one?
A forensic image is an exact, verified copy of a disk or of a computer's memory, made so that investigators can examine it without changing the original. It is taken with dedicated tools, fingerprinted with a hash such as SHA-256 so that any later change can be detected, and stored with a record of who handled it. You need one when the incident may lead to a legal dispute, an insurance claim, a police case or questions from a regulator, and when you want to know how the attacker got in before rebuilding the machine. Ordinary backups are no substitute, because they leave out deleted files, memory and system areas. Let a specialist take it if you can. Network evidence complements it: NetSenX records what crossed the network, which a disk image of a single machine cannot show.