Data Acquisition and Duplication CHFI Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   What is the primary purpose of a hardware write blocker?

   • ATo speed up the imaging process
   • BTo encrypt the data being acquired
   • CTo prevent any write commands from reaching the original storage device
   • DTo compress the image file
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   An examiner is imaging a suspect's laptop drive using a hardware write blocker. The imaging tool reports that the drive is write-protected, but the examiner notices that the drive's SMART attributes show an increase in the 'Power-On Hours' during the acquisition. What is the most likely explanation?

   • AThe write blocker is not functioning correctly and is allowing writes to the drive.
   • BThe imaging tool is writing to the drive despite the write blocker.
   • CThe drive's firmware is updating the SMART attributes during normal operation.
   • DThe drive is failing and the SMART attributes are unreliable.
   Reveal Solution Discussion Select an answer first
4. 53application · easy

   A forensic examiner is about to image a suspect's SATA hard drive. The examiner connects the drive to a forensic workstation using a hardware write blocker. What is the primary purpose of using the write blocker in this scenario?

   • ATo prevent any writes to the original drive during acquisition.
   • BTo convert the SATA interface to USB for easier connection.
   • CTo speed up the imaging process by bypassing the drive's cache.
   • DTo allow the drive to be connected to the workstation without a power supply.
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   An examiner needs to acquire data from a RAID 5 array that is part of a server involved in an investigation. The server is running and the RAID controller is functional. Which acquisition approach is most appropriate?

   • AUse the RAID controller's management software to create a logical copy of the array
   • BPower off the server and remove only one disk from the array for imaging
   • CPerform a live acquisition of the server's memory only
   • DImage each physical disk individually and reconstruct the logical volume in the forensic tool
   Reveal Solution Discussion Select an answer first
6. 55expert · hard

   A forensic examiner is called to investigate a suspected data breach. The affected server is running a critical application that cannot be stopped. The examiner must collect evidence that will be admissible in court. The server is located in a remote data center, and the examiner is at the corporate office. Which combination of actions best balances the need for volatile data, system availability, and legal admissibility?

   • AUse a remote desktop session to view the server's screen and take screenshots as evidence
   • BPerform a live acquisition over the network, capturing memory and system state, and document the process with timestamps and chain of custody
   • CPower off the server immediately and perform a static acquisition of the hard drives
   • DAsk the data center staff to create a backup of the server and send it to the examiner
   Reveal Solution Discussion Select an answer first