What method of copying should always be performed first before carrying out an investigation?

The correct answer is B. Bit-stream copy. A bit-stream copy (also called a forensic image or sector-by-sector copy) duplicates every bit on the source drive, including deleted files, slack space, and unallocated space, producing an exact replica. Investigators always work from this forensic copy, never the original, to…

Submitted by ashley.k· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

AParity-bit copy
BBit-stream copy
CMS-DOS disc copy
DSystem level copy

How the community answered

(28 responses)

A
4% (1)
B
93% (26)
C
4% (1)

Explanation

A bit-stream copy (also called a forensic image or sector-by-sector copy) duplicates every bit on the source drive, including deleted files, slack space, and unallocated space, producing an exact replica. Investigators always work from this forensic copy, never the original, to preserve evidence integrity. Tools like dd or FTK Imager create bit-stream copies. System-level copies and MS-DOS disc copies skip deleted and unallocated data, making them unsuitable for forensic use.

Topics

#Digital Forensics#Evidence Acquisition#Forensic Imaging#Bit-stream copy

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice