Creation should include the following steps:
- Create an imaging plan.
- Connect the device to be imaged to a write blocker.
- Connect or make available a drive to be the destination of the forensic image.
- Create the forensic image on the destination media.
- Identify the hash code of the imaged device.