Jessica, a forensic investigator, was called to investigate an insider threat at a Fortune 500...

Option A. Raw Data Acquisition is correct because a bit-for-bit copy of the original storage medium is the defining characteristic of raw acquisition. CHFI v11 covers data acquisition methods , including the need to preserve evidence integrity and create a faithful duplicate suitable for examination, validation, and possible court use. A raw image captures the disk at the lowest level, including active files, deleted space, slack space, and unallocated areas, making it highly valuable in forensic investigations.

This is different from sparse acquisition , which captures only selected or relevant data rather than the full medium. Differential acquisition is not the standard answer for a complete forensic duplicate in this context. Live data acquisition refers to collecting data from a running system, often to preserve volatile evidence, but it does not itself mean a full bit-stream copy of the storage media.

Because the question explicitly asks for the acquisition method that provides a bit-for-bit copy , the correct answer is raw data acquisition. This aligns directly with CHFI’s focus on choosing the proper imaging method, preserving evidence, and maintaining forensic integrity through accurate duplication of the original media.