You should make at least how many bit-stream copies of a suspect drive?

The correct answer is B. 2. Forensic best practice requires making at least two bit-stream (forensic) copies of a suspect drive. One copy is used as the working copy for analysis, while the second serves as a backup/reference copy to preserve evidence integrity. This ensures that if the working copy is…

Submitted by manish99· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

How the community answered

(59 responses)

A
3% (2)
B
88% (52)
C
7% (4)
D
2% (1)

Explanation

Forensic best practice requires making at least two bit-stream (forensic) copies of a suspect drive. One copy is used as the working copy for analysis, while the second serves as a backup/reference copy to preserve evidence integrity. This ensures that if the working copy is accidentally altered or corrupted during analysis, the original evidence can still be verified against the backup. Working directly on a single copy risks destroying or tainting the only preserved evidence.

Topics

#Bit-stream imaging#Evidence acquisition#Data preservation#Forensic best practices

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice