Which item is used to obtain a clean forensic image of a system or drive for investigations?

• A. Static Malware Analysis
• B. File/data analysis
• C. Imaging tool
• D. VirusTotal

Answer: (C)

Forensically sound imaging of a drive relies on an imaging tool that creates a sector-by-sector copy of the media without altering the original evidence. Imaging tools are designed to preserve integrity, often using a write blocker to prevent any writes to the source and generating a hash of the image to prove it’s an exact copy. They capture all data, including unallocated space and slack areas, which can be important in investigations. This creates a clean, defendable image for analysis while the original remains untouched. The other options aren’t designed to produce a complete forensic image: static malware analysis examines code without running it, file/data analysis looks at extracted files, and VirusTotal is a malware-scanning service, not a tool for imaging drives.