Which tool is used to create a bit-by-bit copy of a storage device for forensic analysis?
- Antivirus
- Disk imaging software
- Firewall
- Encryption tool
Answer: Disk imaging software
Forensic imaging (e.g., FTK Imager, dd) creates exact clones preserving metadata and deleted files. Essential for legal evidence collection without altering original data. [[CERT-In Guidelines]]