A forensically sound duplicate is a “complete and accurate representation of the source evidence” Mike Murr suggests replacing this definition with that of a ‘forensically-sound’ duplicate of a drive. He says it must contain a copy of every bit, byte and sector of the drive, including unallocated ’empty’ space and slack space, precisely as such data appears on the source drive relative to the other data on the drive. That is broad and still accurate enough to refer to hard drives, memory, or network traffic.”]
Source: https://taosecurity.blogspot.com/2006/08/forensically-sound-evidence.html