Name common forensic imaging formats and their characteristics.

• A. Raw (DD) is unstructured; E01 is EnCase's format with metadata; AFF is a cross-platform format with compression
• B. ISO images are always preferred for forensics
• C. VMDK files are only for virtualization
• D. TAR.GZ is the standard imaging format

Answer: (A)

The key idea is understanding the common disk-imaging formats and what each brings to a forensic copy. Raw (DD) images are a sector-by-sector copy of the source drive, unstructured and without embedded metadata, making them the most faithful bit-for-bit replica and highly interoperable with many tools. The E01 format packages the image in an EnCase evidence container that includes metadata, hash values, and optional compression, which supports integrity checks and better chain-of-custody information. AFF (Advanced Forensic File Format) is cross-platform and designed to store metadata and compression, offering flexibility for large datasets and diverse environments.

These traits explain why this option is the best: it names formats that are actually used in practice for forensic imaging and describes their core characteristics. Other statements fall short because ISO images are optical-disc images rather than standard disk-imaging formats for a full drive copy; VMDK is primarily a virtualization disk format, not a general forensic imaging standard; TAR.GZ is an archive, not a disk image, so it doesn’t represent a direct, forensically sound copy of a drive.