Why is it necessary to image a seized computer’s hard drive for forensic analysis?

Why is it necessary to image a seized computer’s hard drive for forensic analysis?
A . To prohibit access to the suspect computer’s hard drive by individuals not professionally trained in forensic analysis
B. To allow for the analysis of data from a suspect computer without altering or damaging the original data in any way
C. To create pictures of the suspect computer system and its wires and cables
D. To enable the retrieval of data from the suspect computer directly via its operating system

View Answer

Answer: C