Question: During the examination and analysis process of a forensics investigation, it is critical that the investigator works from an image that contains all of the data from the original disk. The image must have all but which of the following characteristics?
A. A byte-level copy
B. Captured slack spaces
C. Captured deleted files
D. Captured unallocated clusters

Download pdf (with explanations) edition of this exam.