A disk image backup is used for forensic investigation because it

A.
Is based on secured hardware technology.

B.
Creates a bit level copy of the entire disk.

C.
Time stamps the files with the date and time of the copy operation.

D.
Excludes areas that have never been used to store data.

Explanation:

Never conduct your investigation on an actual system that was compromised. Take the system
offline, make a backup, and use the backup to investigate the incident. – Ed Tittle CISSP Study Guide
(sybex) pg 595