Data Acquisition and Duplication CHFI Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An examiner is investigating a case involving a large file server (20 TB) that contains a mix of active files and deleted data. The investigation is focused on a specific project folder, but the examiner also needs to check for deleted files related to that project. The examiner has limited storage for the image. What is the best acquisition approach?

   • APerform a physical acquisition of the entire 20 TB drive.
   • BPerform a live acquisition of the server's memory.
   • CPerform a logical acquisition of the project folder only.
   • DPerform a sparse acquisition of the project folder and the unallocated space around it.
   Reveal Solution Discussion Select an answer first
2. 17application · easy

   After acquiring a forensic image of a hard drive, an examiner computes an MD5 hash of the image. Later, during analysis, the examiner needs to verify that the image has not been altered. What is the most reliable method to verify the image's integrity?

   • AOpen the image in a hex editor and visually inspect the first few sectors.
   • BCheck the file's creation date and time.
   • CRecompute the MD5 hash of the image and compare it to the original hash.
   • DVerify the image file size matches the original drive's capacity.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which scenario would most likely require a logical acquisition?

   • AInvestigating a suspect's entire hard drive for hidden partitions
   • BCreating a forensic image of a RAID array
   • CRecovering deleted files from unallocated space
   • DCollecting a specific set of emails from a mail server
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In digital forensics, what is the primary purpose of data acquisition?

   • ATo encrypt all data on the original device to ensure confidentiality
   • BTo permanently delete data from a suspect's device to prevent unauthorized access
   • CTo preserve the original evidence in a pristine state while creating a working copy for analysis
   • DTo analyze the data in place on the original device without making any copies
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a common issue when acquiring data from a drive that is connected via a USB adapter?

   • AThe USB adapter is always write-blocked
   • BThe drive may be automatically mounted as read-write by the operating system
   • CThe USB adapter encrypts the data
   • DThe drive cannot be imaged over USB
   Reveal Solution Discussion Select an answer first