GCED: GIAC Certified Enterprise Defender

A bit-for-bit forensic image preserves the full contents of the infected host, including unallocated and slack space, while allowing analysis without modifying the original evidence. NIST recommends performing subsequent analysis on copied media and preserving the original securely.