Computer evidence at a crime is preserved by making an exact copy of the hard disk. Which of the following
does this illustrate?
System image capture
Chain of custody
Order of volatility
A system image would be a snapshot of what exists at the moment. Thus capturing an image of the operating
system in its exploited state can be helpful in revisiting the issue after the fact to learn more about it.