Which of the following would allow the analyst to perform the task?

A security analyst needs to provide a copy of a hard drive for forensic analysis.

Which of the following would allow the analyst to perform the task?

A)

B)

C)

D)

A . Option A
B. Option B
C. Option C
D. Option D

View Answer

Answer: C

Explanation:

Option C shows a device that can perform a forensic copy of a hard drive. A forensic copy, also known as a forensic image or a bit-stream image, is an exact, unaltered digital copy of a piece of digital evidence. A forensic copy captures everything on the hard drive, including active and latent data, and preserves the integrity of the original evidence. A forensic copy can be used for forensic analysis without risking any changes to the original drive1. Option C shows a device that can connect to two hard drives and create a forensic copy from one drive to another using a write-blocker. A write-blocker is a tool that prevents any data from being written to the destination drive, ensuring that only a read-only copy is made2.