Computer evidence at a crime is preserved by making an exact copy of the hard disk. Which of the
following does this illustrate?

A.
Taking screenshots

B.
System image capture

C.
Chain of custody

D.
Order of volatility

Explanation:
A system image would be a snapshot of what exists at the moment. Thus capturing an image of
the operating system in its exploited state can be helpful in revisiting the issue after the fact to
learn more about it.