Direct forensic
Direct forensic imaging is a special case. The difference, however, lies in data being read over deep system interfaces. As with regular forensic imaging, a complete copy of a source drive will be created. This makes it possible to, among other things, image an encrypted hard disk using encryption software.
Please note that direct forensic image is meant to image encrypted disks with the encrypted data. Data is encrypted after the image is restored. If the source drive is an encrypted drive, then it is only possible to run a sector based restoration. A file-based recovery or browse of such an image is of course not possible. Furthermore, spanned volumes (stripped/spanned) are also excluded from this, since the logical link here between the regions is taken over by the operating system. If the drives are not encrypted, making a direct forensic image does not make sense. Here we recommend a forensic image, as all sectors of the drive, including the sectors marked as free, are included in the image.