A forensic image of a drive preserves which of the following?
A) Memory contents
B) File slack and unallocated space
C) System date and time
D) Screen contents

Question

Quizplus · Accepted Answer

A forensic image of a drive captures an exact copy of the drive, including file slack (the space between the end of a file and the end of its allocated space) and unallocated space (space on the drive that is not allocated to any files or directories), but it does not capture memory contents, system date and time, or screen contents, as these are not stored on the drive itself.

A Forensic Image of a Drive Preserves Which of the Following