After making a bit-level copy of compromised server, the forensics analyst Joe wants to verify that he bid not
accidentally make a change during his investigation. Which of the following should he perform?
Take a hash of the image and compare it to the one being investigated
Compare file sizes of all files prior to and after investigation
Make a third image and compare it to the second image being investigated
Compare the logs of the copy to the actual server