Data Acquisition and Duplication CHFI Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   During a forensic acquisition of a suspect's drive, the imaging tool reports that the drive is not responding. The examiner has connected the drive via a hardware write blocker to a forensic workstation. What is the most likely cause of the issue?

   • AThe imaging tool is not licensed for this drive model.
   • BThe write blocker is not compatible with the drive's interface (e.g., SATA vs. IDE).
   • CThe drive is write-protected by the operating system.
   • DThe drive is encrypted and the imaging tool cannot read it.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary difference between static and live acquisition?

   • AStatic acquisition is performed on a powered-off system, while live acquisition is performed on a running system
   • BStatic acquisition is faster than live acquisition
   • CStatic acquisition uses hardware write blockers, while live acquisition uses software write blockers
   • DStatic acquisition captures only volatile data, while live acquisition captures only non-volatile data
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   An examiner has created a forensic image of a drive and computed a hash value. Later, the examiner needs to verify that the image has not been altered since acquisition. The examiner also needs to prove in court that the image matches the original. Which action is most appropriate?

   • ACheck the file size of the image to ensure it matches the original drive's capacity
   • BRecompute the hash of the image and compare it to the original hash value
   • COpen the image in a forensic tool and view a few files to confirm they are present
   • DStore the image on a write-once medium such as a DVD-R
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A forensic examiner responds to an incident involving a compromised server that is currently running. The server hosts critical business applications and cannot be shut down. The examiner needs to capture volatile data such as running processes, network connections, and memory contents. Which acquisition type is most appropriate?

   • ASparse acquisition by collecting only the server's event logs
   • BLive acquisition by running forensic tools on the running system to collect memory and system state
   • CStatic acquisition by powering off the server and imaging the hard drives
   • DLogical acquisition by copying only the application configuration files over the network
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An examiner needs to provide the prosecution with a copy of a suspect's hard drive for review. The examiner copies all visible files to a new drive using the operating system's copy command. Later, the defense argues that the copy is not a true forensic duplicate. Why is this argument valid?

   • AThe copy command creates a compressed image that is not readable
   • BThe copy command does not capture deleted files, unallocated space, or file system metadata
   • CThe copy command modifies the original drive's data
   • DThe copy command only copies the boot sector and partition table
   Reveal Solution Discussion Select an answer first