One important tool of computer forensics is the disk image backup. The disk image backup is:

A.
Copying the system files

B.
Conducting a bit-level copy, sector by sector

C.
Copying and authenticating the system files

D.
Copying the disk directory

Explanation:
Copying sector by sector at the bit level provides the capability to examine slack space, undeleted
clusters and possibly, deleted files. With answer a, only the system files are copied and the other
information recovered in answer b would not be captured. Answer “Copying the disk directory” does
not capture the data on the disk, and answer “Copying and authenticating the system files ” has the
same problem as answer “Copying the system files”. Actually, authenticating the system files is
another step in the computer forensics process wherein a message digest is generated for all system
directories and files to be able to validate the integrity of the information at a later time. This
authentication should be conducted using a backup copy of the disk and not the original to avoid
modifying information on the original. For review purposes, computer forensics is the collecting of
information from and about computer systems that is admissible in a court of law.