After making a bit-level copy of compromised server, the forensics analyst Joe wants to verify that he bid not
accidentally make a change during his investigation. Which of the following should he perform?
A.
Take a hash of the image and compare it to the one being investigated
B.
Compare file sizes of all files prior to and after investigation
C.
Make a third image and compare it to the second image being investigated
D.
Compare the logs of the copy to the actual server