Which description best defines a bitstream copy?

• A. An exact bit-for-bit copy of a drive
• B. A copy of only file contents
• C. A compressed image of the drive
• D. A copy of the directory structure

Answer: (A)

A bitstream copy captures the entire drive exactly as it exists, sector by sector, preserving every bit of data on the media. This means not just the visible files, but also deleted data, slack space, unallocated areas, and critical metadata such as boot sectors and partition tables. Because nothing is reconstructed or altered, the copy is an exact replica, which is essential for forensic integrity and reproducibility—you can hash the image and have a reliable basis for later analysis.

This is why it is the best fit: a file-contents copy would miss data that has been deleted or moved, and slack/unallocated space that might contain artifacts; a compressed image changes the raw byte representation and would need decompression to access data, which can complicate verification of an exact copy; a copy of the directory structure only records what appears in folders, not the actual file data or the underlying file system metadata.