An examiner must acquire a 10 TB RAID array from a server. The acquisition needs to be completed within a limited time window, and the examiner has a forensic workstation with limited storage capacity. Which strategy is most appropriate for handling this large data set?

Use sparse acquisition to collect only the data ranges that are relevant to the investigation

Copy the RAID array using the operating system's backup utility to an external drive

Perform a logical acquisition of only the active user files and folders

Acquire the entire RAID array as a single bit-stream image directly to the workstation's internal drive

EC-CouncilComputer Hacking Forensic Investigator

Domain 2Objective 2

Data Acquisition and Duplication CHFI Practice Questions (Page 12)

Part of the Storage Media, Acquisition and Anti-Forensics domain, which makes up ~18% of our current practice bank.

56questions here

12free pages

14concepts

Questions 56–56

56application · medium
An examiner must acquire a 10 TB RAID array from a server. The acquisition needs to be completed within a limited time window, and the examiner has a forensic workstation with limited storage capacity. Which strategy is most appropriate for handling this large data set?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Data Acquisition and Duplication CHFI Practice Questions (Page 12)

Questions 56–56

An examiner must acquire a 10 TB RAID array from a server. The acquisition needs to be completed within a limited time window, and the examiner has a forensic workstation with limited storage capacity. Which strategy is most appropriate for handling this large data set?

Keep studying — Storage Media, Acquisition and Anti-Forensics