Correct Answer: dd if=/dev/sda of=/imagefile.img
Explanation: dd performs sector-by-sector cloning, preserving deleted data, empty space, and partition metadata—critical for evidence integrity.
Correct Answer: dd if=/dev/sda of=/imagefile.img
Explanation: dd performs sector-by-sector cloning, preserving deleted data, empty space, and partition metadata—critical for evidence integrity.