Computer Hacking Forensic Investigator (CHFI) — Question 79

You should make at least how many bit-stream copies of a suspect drive?

Answer options

• A. 1
• B. 2
• C. 3
• D. 4

Correct answer: B

Explanation

Creating at least two bit-stream copies of a suspect drive ensures that one copy can be used for analysis while the other serves as a backup to preserve the original data integrity. Options A, C, and D are incorrect because they do not meet the recommended practice for data preservation in forensic investigations.