One important tool of computer forensics is the disk image backup. The
disk image backup is:

A.
Copying the system files

B.
Conducting a bit-level copy, sector by sector

C.
Copying and authenticating the system files

D.
Copying the disk directory

Explanation:
Copying sector by sector at the bit level provides the capability to
examine slack space, undeleted clusters and possibly, deleted files.
With answer a, only the system files are copied and the other

information recovered in answer b would not be captured.
Answer “Copying the disk directory” does not capture the data on the disk, and answer “Copying
and authenticating the system files
” has the same problem as answer “Copying the system files”. Actually, authenticating the system
files is another step in the computer forensics process wherein a message
digest is generated for all system directories and files to be able to
validate the integrity of the information at a later time. This
authentication should be conducted using a backup copy of the disk
and not the original to avoid modifying information on the original.
For review purposes, computer forensics is the collecting of information
from and about computer systems that is admissible in a court of law.