Computer Hacking Forensic Investigator (CHFI v10) — Question 123

You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB storage area networks that store customer data.
What method would be most efficient for you to acquire digital evidence from this network?

Answer options

• A. create a compressed copy of the file with DoubleSpace
• B. create a sparse data copy of a folder or file
• C. make a bit-stream disk-to-image file
• D. make a bit-stream disk-to-disk file

Correct answer: C

Explanation

The correct answer is C because making a bit-stream disk-to-image file allows for a complete, exact copy of the data, ensuring that all digital evidence is preserved accurately. Options A and B do not provide a full representation of the data, while option D, while similar, does not focus on imaging, which is typically preferred for forensics.