Certified Incident Handler (ECIH v3) — Question 56

Bit stream image copy of the digital evidence must be performed in order to:

Answer options

• A. Prevent alteration to the original disk
• B. Copy the FAT table
• C. Copy all disk sectors including slack space
• D. All the above

Correct answer: C

Explanation

The correct answer is C because a bit stream image copy captures every sector of the disk, including slack space, which may contain residual data. Options A and B are part of the process but do not encompass the full scope of what a bit stream image copy achieves. Option D is incorrect because not all options are valid in the context of what a bit stream image aims to accomplish.