During a forensic acquisition, the imaging tool reports a read error on a specific sector of the suspect drive. The examiner needs to complete the acquisition while preserving as much data as possible. What should the examiner do?

Restart the acquisition and hope the error does not recur

Stop the acquisition and document the error, then submit the partial image as evidence

Use a tool that continues imaging despite read errors and logs the bad sectors

Switch to a logical acquisition to avoid the bad sectors

During an investigation, an examiner needs to recover deleted files from a specific 50 GB partition on a 2 TB drive. The rest of the drive contains no relevant data. The examiner wants to reduce acquisition time and storage while still capturing the deleted files. Which acquisition technique is most appropriate?

Sparse acquisition of only the 50 GB partition

Logical acquisition of only the currently visible files in the partition

Full physical bit-stream imaging of the entire 2 TB drive

Live acquisition of the system's RAM

An examiner is acquiring a USB drive that is connected to a forensic workstation. The examiner wants to ensure that the acquisition is forensically sound, but the workstation's operating system automatically mounts the USB drive and may write to it. Which approach is the most reliable way to prevent any writes to the USB drive?

Use a software write blocker that intercepts write commands at the driver level

Disable the auto-mount feature in the operating system's registry

Use a hardware write blocker between the USB drive and the workstation

Connect the USB drive to a different port that does not support writes

When is a live acquisition most appropriate in a forensic investigation?

When the computer is powered off and can be transported to a lab

When the system is running and volatile data such as RAM must be captured

When the storage device is encrypted and the key is unknown

When the suspect has already been arrested and the device is seized

What is the main limitation of a logical acquisition compared to a physical acquisition?

It requires specialized hardware write blockers

It is slower and requires more storage space

It cannot be used on encrypted drives

It does not capture deleted files, slack space, or unallocated clusters

EC-CouncilComputer Hacking Forensic Investigator

Domain 2Objective 2

Data Acquisition and Duplication CHFI Practice Questions (Page 10)

Part of the Storage Media, Acquisition and Anti-Forensics domain, which makes up ~18% of our current practice bank.

56questions here

12free pages

14concepts

Questions 46–50

46application · medium
During a forensic acquisition, the imaging tool reports a read error on a specific sector of the suspect drive. The examiner needs to complete the acquisition while preserving as much data as possible. What should the examiner do?
Select an answer first
47application · medium
During an investigation, an examiner needs to recover deleted files from a specific 50 GB partition on a 2 TB drive. The rest of the drive contains no relevant data. The examiner wants to reduce acquisition time and storage while still capturing the deleted files. Which acquisition technique is most appropriate?
Select an answer first
48expert · hard
An examiner is acquiring a USB drive that is connected to a forensic workstation. The examiner wants to ensure that the acquisition is forensically sound, but the workstation's operating system automatically mounts the USB drive and may write to it. Which approach is the most reliable way to prevent any writes to the USB drive?
Select an answer first
49foundation · easy
When is a live acquisition most appropriate in a forensic investigation?
Select an answer first
50foundation · easy
What is the main limitation of a logical acquisition compared to a physical acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Data Acquisition and Duplication CHFI Practice Questions (Page 10)

Questions 46–50

During a forensic acquisition, the imaging tool reports a read error on a specific sector of the suspect drive. The examiner needs to complete the acquisition while preserving as much data as possible. What should the examiner do?

When is a live acquisition most appropriate in a forensic investigation?

What is the main limitation of a logical acquisition compared to a physical acquisition?

Keep studying — Storage Media, Acquisition and Anti-Forensics