A security administrator needs to image a large hard drive for forensic analysis. Which of the following will allow for faster imaging to a second hard drive?

The `cp` command copies files and directories at the filesystem level and cannot create a complete forensic block-level image of an entire disk.

`tail -f` streams the end of a text file in real time and is not a disk duplication utility; the syntax shown is nonsensical for this purpose.

The `dd` utility reads and writes raw disk blocks, preserving the exact bit-for-bit image of the source drive including unallocated space, which is required for forensic integrity. Setting a larger block size (bs=4k) batches reads and writes, reducing system call overhead and accelerating the imaging process compared to the default 512-byte block size.

`locate` is a file-search command that queries a filename database and has no capability to copy disk data.