A forensic examiner is acquiring a disk image from a compromised workstation. Which tool is most appropriate for creating a forensically sound image while preserving hash integrity?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because dd and dc3dd create bit-for-bit forensic images and dc3dd adds hash verification during acquisition to prove image integrity. A is wrong because xcopy copies files at the OS level, missing unallocated space, deleted files, and metadata critical for forensic analysis.
Full explanation below image
Full Explanation
B is correct because dd and dc3dd create bit-for-bit forensic images and dc3dd adds hash verification during acquisition to prove image integrity. A is wrong because xcopy copies files at the OS level, missing unallocated space, deleted files, and metadata critical for forensic analysis. C is wrong because tar creates file archives, not bit-for-bit disk images, and compression alters the data. D is wrong because Robocopy mirrors files at the filesystem level, not raw disk sectors.