An examiner is investigating a case where the suspect's computer contains a large 4 TB drive, but the investigation only requires emails and chat logs from a specific user profile. The examiner wants to minimize acquisition time and storage requirements while still collecting the relevant data. Which acquisition method should be used?

Logical acquisition of the user profile folders containing emails and chat logs

Physical acquisition of the entire drive

Sparse acquisition of only the unallocated space

Live acquisition of the system memory

An examiner needs to acquire a RAID 5 array from a server that has one failed disk. The server is still running and the RAID is in a degraded state. What is the most appropriate acquisition approach?

Use a software RAID tool to reconstruct the array from the remaining disks.

Power off the server and acquire each physical disk individually.

Replace the failed disk first, then acquire the RAID.

Acquire the logical volume using the RAID controller while the server is running.

After creating a forensic image of a suspect's drive, the examiner needs to prove in court that the image is identical to the original evidence. Which step is essential to verify the integrity of the acquired image?

Computing a hash value of the original drive and the image and comparing them

Ensuring the image file is stored on a network share

Reviewing the directory structure of the image

Checking the file timestamps on the image files

Which strategy is commonly used to manage the acquisition of very large data sets?

Acquiring only the active files to reduce size

Skipping the hashing step to save time

Using compression and segmentation of the image

Using a faster network connection

An incident response team needs to acquire data from a remote server located in another city. The server is critical and cannot be taken offline. The team wants to capture a forensic image of the server's hard drive over the network. Which technique is most appropriate?

Ask a local administrator to copy the entire drive to a USB drive and mail it

Power off the server and ship the physical drive to the forensic lab

Use a screen capture tool to record the server's console output

Use a remote acquisition tool that creates a bit-stream image over the network

EC-CouncilComputer Hacking Forensic Investigator

Domain 2Objective 2

Data Acquisition and Duplication CHFI Practice Questions (Page 2)

Part of the Storage Media, Acquisition and Anti-Forensics domain, which makes up ~18% of our current practice bank.

56questions here

12free pages

14concepts

Questions 6–10

6application · medium
An examiner is investigating a case where the suspect's computer contains a large 4 TB drive, but the investigation only requires emails and chat logs from a specific user profile. The examiner wants to minimize acquisition time and storage requirements while still collecting the relevant data. Which acquisition method should be used?
Select an answer first
7application · medium
An examiner needs to acquire a RAID 5 array from a server that has one failed disk. The server is still running and the RAID is in a degraded state. What is the most appropriate acquisition approach?
Select an answer first
8application · medium
After creating a forensic image of a suspect's drive, the examiner needs to prove in court that the image is identical to the original evidence. Which step is essential to verify the integrity of the acquired image?
Select an answer first
9foundation · easy
Which strategy is commonly used to manage the acquisition of very large data sets?
Select an answer first
10application · medium
An incident response team needs to acquire data from a remote server located in another city. The server is critical and cannot be taken offline. The team wants to capture a forensic image of the server's hard drive over the network. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.