Mysystem.org IT ExamsCISSP-Question-350 2017-04-02
Question: During the examination and analysis process of a forensics investigation, it is critical that the investigator works from an image that contains all of the data from the original disk. The image must have all but which of the following characteristics?
Answer ==> A. A byte-level copy
B. Captured slack spaces
C. Captured deleted files
D. Captured unallocated clusters