CompTIA CS0-003 Exam - Topic 4 Question 67 Discussion

A bit-level image is a forensic-grade copy that preserves all data on a disk, including unallocated space, deleted files, and metadata. This is the most legally defensible form of digital evidence collection, as it ensures that no potential evidence is missed.

Copying all access files (Option A) only captures live files and omits deleted or system-level artifacts that may be critical.

Creating a file-level archive (Option B) is insufficient because it does not capture system metadata or slack space where forensic artifacts reside.

Providing a full system backup inventory (Option C) may include important files, but it lacks forensic integrity because backups often modify timestamps and do not capture all system states.

Thus, the correct answer is D, as a bit-level image ensures forensic integrity and completeness of evidence.