What characteristics define a forensic image?

• A. A compressed archive of user documents.
• B. A bit-for-bit copy of storage media that is verifiable, complete, and preserved with chain of custody.
• C. Any copy of the disk's files without integrity checks.
• D. A live image created while the system is running.

Answer: (B)

A forensic image is an exact, bit-for-bit copy of the storage media that can be verified, is complete, and preserved with chain of custody. Being exact means every sector is copied, including unallocated space, slack space, and hidden or deleted data, so the replica truly mirrors the original state. Verifiability comes from computing and comparing cryptographic hashes (such as SHA-256) of the original and the copy to prove nothing changed during acquisition. Completeness ensures no parts of the drive are omitted, including partitions and metadata, which is essential for a thorough analysis and for maintaining evidentiary value. Chain of custody documentation guarantees the evidence’s integrity over time by recording who handled it, when, and under what conditions.

This approach contrasts with a compressed archive of only user documents, which omits many areas of the drive and can’t guarantee integrity or completeness. A simple copy of the disk’s files without integrity checks misses hidden and deleted data and unallocated space that could contain important evidence. A live image taken while the system is running can alter data and doesn’t provide a stable, unchanging snapshot of the entire drive, which is why a static, verifiable, bit-for-bit capture with proper custody is the appropriate definition of a forensic image.