What is the PRIMARY reason that a bit-level copy is more desirable than a file-level copy when replicating a hard drives contents for an e-discovery investigation?
A.
The corruption of files is less likely.
B.
Files that have been deleted will be transferred.
C.
The file and directory structure is retained.
D.
File-level security settings will be preserved.
B. Files that have been deleted will be transferred.
A bit-level copy, also known as a forensic image, replicates all sectors of a storage device, including deleted files and unallocated space, making it essential for capturing all data, including potential evidence that may not be accessible through a file-level copy.
Bit-by-bit copy means to copy all areas of a computer hard drive or other storage devices. It replicates all sectors including blank sectors and logically bad sectors, so it is also called sector-by-sector clone. The data stored on the cloned drive is identical to the data on the original drive.
The best way to collect electronic evidence is by creating a forensic image of the source media. A forensic image will create a bit-for-bit copy of the original media, ensuring data accuracy. These bit-level images include data that may have been deleted or otherwise not accessible to the end-user or operating system.
https://solutions.teamavalon.com/blog/forensic-imaging-a-better-approach-to-ediscovery
upvoted 3 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Soleandheel
11 months, 2 weeks agoIvanchun
1 year, 11 months agojackdryan
1 year, 6 months agordy4u
2 years agofranbarpro
2 years, 1 month ago