Bit Stream Backup - Defined
Bit stream backups (also referred to as mirror image backups) involve the backup of all areas of a computer hard disk drive or another type of storage media, e.g., Zip disks, floppy disks, Jazz disks, etc. Such backups exactly replicate all sectors on a given storage device. Thus, all files and ambient data storage areas are copied. Bit stream backups are sometimes also referred to as 'evidence grade' backups and they differ substantially from traditional computer file backups and network server backups.
The making of a bit stream backup is simple in theory but the accuracy of the backup must meet evidence standards. Accuracy is essential and to guarantee accuracy, bit stream backup programs rely upon mathematical CRC computations in the validation process. These mathematical validation processes compare the original source data with the restored data. When computer evidence is involved, accuracy is extremely important and the making of a bit stream backup is sometimes described as the preservation of the 'electronic crime scene'.
Several bit stream backup products exist in the marketplace but only a select few have withstood the test of time and the rigors of the criminal trial process. SafeBack has become an industry standard in the field of computer forensics and in the processing of computer evidence in both criminal and civil proceedings. Because of the quality and popularity of the software, NTI purchased all rights to the product from Sydex, Inc., in 2000 and it was upgraded in 2003 to incorporate the NIST tested SHA256 algorithm. SafeBack was a solid product before the upgrade and it is even better now.
The actual making of bit stream backups is not as simple as it might seem and much technical knowledge is required on the part of the computer specialist who operates the software and makes the backup. This is because not all hard disk drives are made the same, BIOS vary from computer to computer and sophisticated hard disk drive translation can fool some bit stream backup software programs. Other issues relate to hard disk drive geometry and storage methodologies, e.g., raid computer network configurations. For this reason, the making of a bit stream backup does not just involve the mere operation of software. It is imperative that the individual making the backup is trained. NTI's 5 Day Computer Forensics Training Course covers this topic in detail and are the most technical courses that are available. NTI has also created a special Bit Stream Backup Training Course which covers the basic issues as well as the more technical issues associated with the making of a bit stream backup copy of the contents of a hard disk drive.
As previously mentioned, translation issues can cause problems for the creation of a bit stream backup. The topic of translation is complex. To illustrate the complexities, consider the fact that most computer hard disk drives report numerous heads and cylinders when they are evaluated with data recovery software. The number of heads reported may be 15 but in reality the drive may only have a few heads. Translation is the culprit and a physical examination of the heads and platters would be required to confirm the actual architecture of the drive. This situation can fool many bit stream backup software utilities. It can also create complexities for the restoration of bit stream backups made of raid configured network servers. Without an accurate bit stream backup, the results of computer evidence processing may be inaccurate.
