Editing Disk cloning (section)

=== Digital forensics ===
One of the most common applications of disk cloning is for digital forensics purposes.<ref>{{Cite book |last1=Manson |first1=Dan |last2=Carlin |first2=Anna |last3=Ramos |first3=Steve |last4=Gyger |first4=Alain |last5=Kaufman |first5=Matthew |last6=Treichelt |first6=Jeremy |title=2007 40th Annual Hawaii International Conference on System Sciences (HICSS'07) |chapter=Is the Open Way a Better Way? Digital Forensics Using Open Source Tools |date=2007 |chapter-url=https://ieeexplore.ieee.org/document/4076922 |pages=266b |doi=10.1109/HICSS.2007.301|s2cid=15273267}}</ref> This aims to ensure that data is preserved at the time it was acquired for later analysis.<ref name=":5">{{Cite journal |last1=Meffert |first1=Christopher S. |last2=Baggili |first2=Ibrahim |last3=Breitinger |first3=Frank |date=2016-08-07 |title=Deleting collected digital evidence by exploiting a widely adopted hardware write blocker |url=https://digitalcommons.newhaven.edu/context/electricalcomputerengineering-facpubs/article/1056/viewcontent/Deleting_Collected_Digital_Evidence___WriteBlocker.pdf |journal=Digital Investigation |language=en |volume=18 |pages=S87–S96 |doi=10.1016/j.diin.2016.04.004 |issn=1742-2876|doi-access=free }}</ref> Techniques for cloning a disk for forensic purposes differ from cloning a drive for other purposes. Typically, the cloning process itself must not interfere with the data. Because software cannot be installed on the system, a hardware-based cloner is generally used to duplicate the data to another drive or image.<ref name=":0"/> Further, the hardware-based cloner also has write-blocking capabilities which intercepts write commands to prevent data being written to the drive.<ref name=":5"/>