The EnCase evidence file is best described as:
A clone of the source hard drive.
A sector-by-sector copy of the source hard drive written to the corresponding sectors of the target hard drive.
A bit stream image of the source hard drive written to the corresponding sectors of the target hard drive.
A bit stream image of the source hard drive written to a file, or several file segments.
Submit