What is the minimum number of bitstream copies you should make of a suspect drive?

• A. One
• B. Two or more
• C. Three
• D. Four

Answer: (B)

In digital forensics, you preserve evidence by making exact bit-for-bit copies of the drive and never work on the original. The minimum you should make is two or more copies. This provides redundancy and enables independent verification of findings: one image can be used for analysis, while another serves as a backup or for verification if any questions arise about the results. Each copy should be hash-verified to prove integrity, and imaging should be done with a write blocker so no data is altered on the source. Relying on a single copy risks compromising the evidence if that copy becomes corrupted or disputed.