Computer Hacking Forensic Investigator (CHFI v10) — Question 521

Which of the following technique creates a replica of an evidence media?

Answer options

• A. Data Extraction
• B. Backup
• C. Bit Stream Imaging
• D. Data Deduplication

Correct answer: C

Explanation

Bit Stream Imaging is the correct answer because it creates an exact replica of the data on a storage device, capturing all bits including unallocated space. The other options do not specifically create a bit-by-bit copy of the media; Data Extraction focuses on retrieving specific data, Backup refers to general data copies for recovery, and Data Deduplication is aimed at reducing storage by eliminating duplicate data.