Computer evidence at a crime is preserved by making an exact copy of the hard disk. Which of the following
does this illustrate?

A.
Taking screenshots

B.
System image capture

C.
Chain of custody

D.
Order of volatility

Explanation:
A system image would be a snapshot of what exists at the moment. Thus capturing an image of the operating
system in its exploited state can be helpful in revisiting the issue after the fact to learn more about it.