During a forensic investigation, a systems administrator indicates that she is in possession of a copy backup of the compromised system. This backup was taken a few hours before an attack disabled the system. You must decide whether to use the copy backup to restore the system. What is this type of backup?

A. a backup that backs up all the files similar to full backups but does not reset the file's archive bit
B. a backup which uses a file's time stamp to determine if it needs archiving
C. a backup in which all files that have been changed since the last full backup will be backed up and the archive bit for each file is not cleared
D. a backup in which all files that have been changed since the last full or incremental backup will be backed up and the archive bit for each file is cleared

A
Explanation: A copy backup backs up all the files similar to full backups but does not reset the file's archive bit.
A daily backup is a backup which uses a file's time stamp to determine if it needs archiving. A differential backup is a backup in which all files that have been changed since the last full backup will be backed up and the archive bit for each file is not cleared. An incremental backup is a backup in which all files that have been changed since the last full or incremental backup will be backed up and the archive bit for each file is cleared.