What is the purpose of creating more than one bitstream copy of a suspect drive?

• A. To preserve evidence integrity across copies
• B. To speed up analysis
• C. To save storage space
• D. To undermine the chain of custody

Answer: (A)

Preserving evidence integrity across copies is the primary reason for creating more than one bitstream copy of a suspect drive. In forensic practice, you image the drive bit-for-bit so the original remains unaltered, and the copies become the working datasets for analysis. Having multiple copies lets you verify results across copies by comparing cryptographic hashes, which shows that each copy is a faithful replica of the original. It also enables parallel workflows and reduces the risk that a single analysis could accidentally modify or contaminate the original data. Additionally, redundancy protects against data loss if a copy becomes unreadable or corrupted, and it supports clear chain-of-custody documentation by showing how each copy was handled and validated.