Which copying method is emphasized to ensure the data is not changed during evidence gathering?

• A. One-to-one copy
• B. Make a bit-level copy
• C. Backing up log files
• D. Restore and repair any damage

Answer: (A)

Preserving evidence requires obtaining an exact duplicate of the data without touching the original. A one-to-one copy provides that exact mirror, capturing every bit, including hidden areas and metadata, so the original remains untouched during collection. This level of exact replication ensures the evidence can be analyzed and verified later, and it supports a solid chain of custody. In practice, you’d use a write blocker to prevent any writes to the source during the copy. Other options don’t guarantee a complete, untouched replica: backing up log files misses much of the data, restoring or repairing would change the original, and while a bit-level copy also aims for exact duplication, the emphasis here on a one-to-one copy highlights the need for a pristine, uncompromised clone.