During the examination and analysis process of a forensics investigation, it is critical that the investigator works from an image that contains all of the data from the original disk. The image must have all but which of the following characteristics?

A.
A byte-level copy

B.
Captured slack spaces

C.
Captured deleted files

D.
Captured unallocated clusters

Explanation:
It must be a bit-level copy, sector by sector, to capture deleted
files, slack spaces, and unallocated clusters. These types of images can be created
through the use of a specialized tool such as FTK Imager, EnCase, Safeback, or the
-dd Unix utility.