Which is a valid property of disk imaging when capturing evidence?

Which is a valid property of disk imaging when capturing evidence?

• A. It changes the original data
• B. It logs I/O errors in an accessible format
• C. It lacks auditability
• D. It avoids hashing the bit-stream

Answer: (B)

Disk imaging must be non-intrusive and reproducible, preserving an exact bit-for-bit copy of the original evidence. A key property is that the imaging process logs I/O errors in an accessible format. This means any read failures, unreadable sectors, or other issues are documented clearly and can be reviewed later. Such logs help establish what was successfully captured, where data might be missing, and how the image was produced, supporting transparency, reproducibility, and a solid chain of custody. Keeping the original data unchanged is essential, so imaging should not alter the source. Auditability is crucial for trust, and hashing the bit-stream is a standard practice to verify integrity, so the option about avoiding hashing isn’t valid. If there are I/O errors, having accessible logs provides vital context for the completeness and reliability of the evidence.

Disk imaging must be non-intrusive and reproducible, preserving an exact bit-for-bit copy of the original evidence. A key property is that the imaging process logs I/O errors in an accessible format. This means any read failures, unreadable sectors, or other issues are documented clearly and can be reviewed later. Such logs help establish what was successfully captured, where data might be missing, and how the image was produced, supporting transparency, reproducibility, and a solid chain of custody.

Keeping the original data unchanged is essential, so imaging should not alter the source. Auditability is crucial for trust, and hashing the bit-stream is a standard practice to verify integrity, so the option about avoiding hashing isn’t valid. If there are I/O errors, having accessible logs provides vital context for the completeness and reliability of the evidence.