Which step is essential when creating a bit-stream image of a suspect's hard drive?

Using a write blocker to prevent any modification to the original drive

Ensuring the suspect's drive is mounted as read-write to allow full access

Copying only the active files to a new drive

Formatting the suspect's drive before imaging to ensure a clean copy

A forensic examiner has acquired a bit-stream image of a suspect's drive. The examiner computes a SHA-256 hash of the image and records it in the chain of custody. Later, during analysis, the examiner mounts the image as read-only and computes the hash again. The hash matches. What does this verify?

That the image was acquired from the correct suspect drive.

That the image is free of any malware.

That the image has not been altered since acquisition.

That the image was acquired using a write blocker.

What is a common technique for remote acquisition over a network?

Using a forensic imaging tool that supports network streaming

Physically removing the hard drive and shipping it to the lab

What is the main purpose of maintaining a chain of custody during evidence acquisition?

To ensure the evidence is stored in a secure location

To encrypt the evidence to prevent tampering

To document every person who handled the evidence and when

To speed up the acquisition process

EC-CouncilComputer Hacking Forensic Investigator

Domain 2Objective 2

Data Acquisition and Duplication CHFI Practice Questions (Page 3)

Part of the Storage Media, Acquisition and Anti-Forensics domain, which makes up ~18% of our current practice bank.

56questions here

12free pages

14concepts

Questions 11–15

11foundation · easy
Which step is essential when creating a bit-stream image of a suspect's hard drive?
Select an answer first
12expert · medium
A forensic examiner has acquired a bit-stream image of a suspect's drive. The examiner computes a SHA-256 hash of the image and records it in the chain of custody. Later, during analysis, the examiner mounts the image as read-only and computes the hash again. The hash matches. What does this verify?
Select an answer first
13foundation · easy
Which tool is commonly used for forensic imaging and supports multiple output formats?
Select an answer first
14foundation · easy
What is a common technique for remote acquisition over a network?
Select an answer first
15foundation · easy
What is the main purpose of maintaining a chain of custody during evidence acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Data Acquisition and Duplication CHFI Practice Questions (Page 3)

Questions 11–15

Which step is essential when creating a bit-stream image of a suspect's hard drive?

Which tool is commonly used for forensic imaging and supports multiple output formats?

What is a common technique for remote acquisition over a network?

What is the main purpose of maintaining a chain of custody during evidence acquisition?

Keep studying — Storage Media, Acquisition and Anti-Forensics