An examiner must acquire a 2 TB SATA hard drive from a suspect's desktop computer. The drive is not encrypted and the system is powered off. The examiner wants to preserve the exact state of the drive, including deleted files and unallocated space, while ensuring no data is altered during the process. Which approach should the examiner use?

Duplicate the drive by copying all visible files to an external USB drive using the operating system's copy command.

Boot the suspect system and run a software imaging tool that creates a logical copy of active files.

Remove the drive, connect it to a forensic workstation through a hardware write blocker, and create a bit-stream image.

Use a software write blocker on the suspect system and perform a sparse acquisition of only the user's documents folder.

Why is a forensic image considered more reliable than a simple duplication for legal proceedings?

Because it is created by law enforcement only

Because it is created using specialized hardware

Because it is compressed to save space

Because it includes a hash value and documentation of the acquisition process

What is a key consideration when acquiring data from a RAID array?

The RAID controller must be removed before imaging

The logical volume may need to be imaged rather than individual disks

Each disk must be imaged in a random order

Write blockers are not needed for RAID arrays

Why might an investigator choose to image each disk in a RAID array individually?

To speed up the acquisition process

To reduce the total amount of data acquired

To preserve the exact state of each physical disk for potential reconstruction

EC-CouncilComputer Hacking Forensic Investigator

Domain 2Objective 2

Data Acquisition and Duplication CHFI Practice Questions (Page 1)

Part of the Storage Media, Acquisition and Anti-Forensics domain, which makes up ~18% of our current practice bank.

56questions here

12free pages

14concepts

Questions 1–5

1application · medium
An examiner must acquire a 2 TB SATA hard drive from a suspect's desktop computer. The drive is not encrypted and the system is powered off. The examiner wants to preserve the exact state of the drive, including deleted files and unallocated space, while ensuring no data is altered during the process. Which approach should the examiner use?
Select an answer first
2foundation · easy
Why is a forensic image considered more reliable than a simple duplication for legal proceedings?
Select an answer first
3foundation · easy
What is a key consideration when acquiring data from a RAID array?
Select an answer first
4foundation · easy
Why might an investigator choose to image each disk in a RAID array individually?
Select an answer first
5application · easy
An examiner is about to image a SATA hard drive that was seized as evidence. The examiner wants to ensure that the imaging process does not modify the original drive. Which tool or device should be used between the drive and the forensic workstation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Data Acquisition and Duplication CHFI Practice Questions (Page 1)

Questions 1–5

Why is a forensic image considered more reliable than a simple duplication for legal proceedings?

What is a key consideration when acquiring data from a RAID array?

Why might an investigator choose to image each disk in a RAID array individually?

An examiner is about to image a SATA hard drive that was seized as evidence. The examiner wants to ensure that the imaging process does not modify the original drive. Which tool or device should be used between the drive and the forensic workstation?

Keep studying — Storage Media, Acquisition and Anti-Forensics