Certified Information Systems Security Professional (CISSP) — Question 71

What is the PRIMARY reason that a bit-level copy is more desirable than a file-level copy when replicating a hard drives contents for an e-discovery investigation?

Answer options

• A. The corruption of files is less likely.
• B. Files that have been deleted will be transferred.
• C. The file and directory structure is retained.
• D. File-level security settings will be preserved.

Correct answer: B

Explanation

The correct answer is B because a bit-level copy captures every bit of data, including deleted files that may not be visible in a file-level copy. Options A, C, and D are benefits of bit-level copies but do not specifically address the critical aspect of recovering deleted files, which is paramount in e-discovery investigations.