In digital forensics, which process creates a bit-for-bit copy of storage media to preserve evidence?

• A. File Carving
• B. Imaging
• C. Analysis
• D. Duplication

Answer: (B)

Creating a forensic image is the process of producing a bit-for-bit copy of the entire storage device, including all data, unallocated space, and metadata. This preserves the evidence exactly as it exists, so investigators can analyze a copy without altering the original. Write-blockers are typically used to prevent any writes to the source, and hashes (like SHA-256) are generated to prove the image is identical to the original and to maintain the chain of custody. This approach ensures the integrity and reproducibility of the examination.

File carving, by contrast, targets recovering files from raw data based on signatures and does not create a complete copy of the drive. Analysis is the examination phase performed on the image. Duplication can refer to copying data but does not inherently guarantee a bit-for-bit, forensically sound image with preserved unallocated space and metadata.