Detective Harris is leading a digital forensics investigation into a cyberattack on a local bank's...

According to the CHFI v11 objectives underData Acquisition Concepts and RulesandDigital Evidence Handling, the most critical step in preserving original evidence integrity is the creation of aduplicate bit-stream imageof the suspect media. A bit-stream image (also known as a forensic image) is an exact sector-by-sector copy of the original storage device, including allocated space, unallocated space, slack space, and hidden data. This ensures that no data is altered, added, or omitted during acquisition.

CHFI v11 clearly states one of the fundamentalrules of thumb for data acquisition:never perform analysis on original evidence. Instead, investigators must work exclusively on verified copies while the original evidence is preserved in a secured state. Hash values are calculated before and after imaging to confirm that the duplicate image is an exact replica, thereby supportingchain of custodyandcourt admissibility.

Options C and D violate forensic best practices by risking accidental modification of the original evidence, which could render it legally inadmissible. Using multiple tools simultaneously (Option B) does not inherently preserve integrity and may introduce inconsistencies if not properly validated.

The CHFI Exam Blueprint v4 emphasizes forensic imaging and validation as mandatory steps in evidence preservation, makingcreating a duplicate bit-stream imagethe correct and exam-aligned answer