I think they got a forensics report from Crowdstrike, not an image, but it's hard to tell for sure because the people making statements aren't fully aware of the distinction most likely.

The fact that I can't find specific reference to an image being provided, just "forensics", would lead me to suspect that an image was not provided, as otherwise later clarification on this point would have been beneficial to some parties involved. Then again, maybe I'm just missing it.