A security administrator needs to image a large hard drive for forensic analysis. Which of the following will allowfor faster imaging to a second hard drive?

A.
cp /dev/sda /dev/sdb bs=8k

B.
tail -f /dev/sda > /dev/sdb bs=8k

C.
dd in=/dev/sda out=/dev/sdb bs=4k

D.
locate /dev/sda /dev/sdb bs=4k

Explanation:
dd is a command-line utility for Unix and Unix-like operating systems whose primary purpose is to convert and
copy files. dd can duplicate data across files, devices, partitions and volumes
On Unix, device drivers for hardware (such as hard disks) and special device files (such as /dev/zero and /dev/
random) appear in the file system just like normal files; dd can also read and/or write from/to these files,
provided that function is implemented in their respective driver. As a result, dd can be used for tasks such as
backing up the boot sector of a hard drive, and obtaining a fixed amount of random data. The dd program can
also perform conversions on the data as it is copied, including byte order swapping and conversion to and from
the ASCII and EBCDIC text encodings.
An attempt to copy the entire disk using cp may omit the final block if it is of an unexpected length; whereas dd
may succeed. The source and destination disks should have the same size.