An examiner needs to acquire a drive that is larger than the destination media. What is the best approach?
-
A
Skip unallocated space to reduce image size
-
B
Use compression in EnCase to reduce the image size
-
C
Use multiple destination drives with segmented image files
-
D
Acquire only the active partitions