Typically, a binary image of a hard drive is immediately created when a forensic examination begins. This is done to stem the possibility of the hard drive contents being altered during examination.