An ISO image is best described as which type of forensic evidence?

An ISO image is best described as which type of forensic evidence?

• A. An unmodified live memory capture
• B. A sector-by-sector copy of optical media
• C. A decrypted backup of network traffic
• D. A compressed archive of file system metadata

Answer: (B)

An ISO image is a sector-by-sector copy of optical media, capturing every bit as it exists on the disc. This bit-for-bit replica preserves the filesystem, boot information, and even unused space, which is crucial for forensics when you need an exact representation of the original media. Because it is a precise clone, you can hash the image to verify integrity and analyze it without modifying the original disc. This differs from memory captures, which are volatile and not stored on optical media; from decrypted network traffic backups, which are not the disc’s exact bitstream; and from compressed archives of metadata, which do not preserve the complete disc bitstream or slack space.

An ISO image is a sector-by-sector copy of optical media, capturing every bit as it exists on the disc. This bit-for-bit replica preserves the filesystem, boot information, and even unused space, which is crucial for forensics when you need an exact representation of the original media. Because it is a precise clone, you can hash the image to verify integrity and analyze it without modifying the original disc.

This differs from memory captures, which are volatile and not stored on optical media; from decrypted network traffic backups, which are not the disc’s exact bitstream; and from compressed archives of metadata, which do not preserve the complete disc bitstream or slack space.