A forensic examiner is acquiring a disk image from a compromised workstation. Which tool is most appropriate for creating a forensically sound image while preserving hash integrity?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need dd or dc3dd with MD5/SHA-256 hash verification because it creates a bit-for-bit forensic image and proves integrity during acquisition. The xcopy, tar, and Robocopy options don't preserve the raw disk sectors you need.
Full Explanation
The correct choice is dd or dc3dd with MD5/SHA-256 hash verification because dd and dc3dd create bit-for-bit forensic images, and dc3dd adds hash verification during acquisition to prove image integrity. The xcopy with the /H flag to include hidden files option is wrong because xcopy copies files at the OS level, missing unallocated space, deleted files, and metadata critical for forensic analysis. The tar with compression to reduce image size option is wrong because tar creates file archives, not bit-for-bit disk images, and compression alters the data. The Robocopy with the /MIR flag for mirror copy option is wrong because Robocopy mirrors files at the filesystem level, not raw disk sectors.