A computer forensics examiner is about to conduct a forensics examination of a computer’s hard drive and anticipates that he will be cross-examined in a deposition. What should the examiner do to...

A computer forensics examiner is about to conduct a forensics examination of a computer’s hard drive and anticipates that he will be cross-examined in a deposition. What should the examiner do to ensure that the image he takes of the computer’s hard drive is an exact copy of the hard drive?

a. Reconcile the numbers of files and directories on the original and copied image

b. Perform SHA-1 and MD5 checksums of the original drive and the copied image

c. Use a write blocker when making a copy of the original drive

d. Make a copy of the hard drive and perform forensics on the original