Examine the imaged data in raw form
If desired, the imaged data can be examined as a byte-for-byte image
- For file systems, this grants access to slack space, deleted file areas, blocks marked as ‘bad’, directory areas, partition tables, etc.
- For tapes, this grants access to tape formatting information, tape headers and trailers, etc.
- For IP traffic, this grants access to the raw collected data in the sequence it was observed.