An IR team is performing forensic disk acquisition of a Windows workstation suspected of data exfiltration. Which tool and method represent best practice for forensic imaging?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because a hardware write blocker prevents any modification to the evidence drive, forensic imaging tools capture a bit-for-bit copy including slack space and deleted files, and hashing before/after verifies the image is an exact copy — meeting forensic admissibility standards. A is wrong because Windows Explorer only copies accessible files, misses deleted/system files, and modifies file access timestamps on the source.
Full explanation below image
Full Explanation
B is correct because a hardware write blocker prevents any modification to the evidence drive, forensic imaging tools capture a bit-for-bit copy including slack space and deleted files, and hashing before/after verifies the image is an exact copy — meeting forensic admissibility standards. A is wrong because Windows Explorer only copies accessible files, misses deleted/system files, and modifies file access timestamps on the source. C is wrong because booting the suspect machine without a write blocker may modify the disk (swap, logs, timestamps). D is wrong because Windows Backup creates a system restore image, not a forensic evidence image, and does not preserve deleted data.