In forensic reporting, which statement best describes an ISO image captured from optical media?

In forensic reporting, which statement best describes an ISO image captured from optical media?

• A. It is a live memory dump
• B. It is a decrypted database export
• C. It is a sector-by-sector copy preserving discs' contents
• D. It is a captured network packet trace

Answer: (C)

An ISO image is a sector-by-sector copy of optical media, preserving every byte and the exact layout of the disc, including unused sectors and filesystem metadata. This faithful replica lets you mount or analyze the disc contents as they existed on the original media, and you can verify integrity with a hash to ensure it hasn’t changed. It’s not a memory dump (that would capture volatile RAM), not a decrypted database export (which extracts data from a database), and not a network packet trace (which records network traffic).

An ISO image is a sector-by-sector copy of optical media, preserving every byte and the exact layout of the disc, including unused sectors and filesystem metadata. This faithful replica lets you mount or analyze the disc contents as they existed on the original media, and you can verify integrity with a hash to ensure it hasn’t changed. It’s not a memory dump (that would capture volatile RAM), not a decrypted database export (which extracts data from a database), and not a network packet trace (which records network traffic).