Data Acquisition and Duplication CHFI Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A forensic examiner is asked to provide a copy of a suspect's hard drive to the defense attorney. The examiner creates a bit-stream image of the original drive and provides the image file to the attorney. The attorney complains that the image cannot be opened on a standard Windows computer. What is the most likely reason?

   • AThe image is too large to be opened on a standard computer.
   • BThe image was encrypted by the forensic tool.
   • CThe image is corrupted due to a bad sector on the original drive.
   • DThe image is in a forensic format (e.g., E01) that requires specialized software to open.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   During acquisition, the imaging process fails due to bad sectors on the source drive. What is the recommended course of action?

   • AFormat the drive and try again
   • BAbort the acquisition and label the drive as unusable
   • CIncrease the block size to avoid bad sectors
   • DUse a forensic tool that can skip bad sectors and continue imaging
   Reveal Solution Discussion Select an answer first
4. 28application · easy

   A forensic examiner has just completed imaging a suspect's hard drive. The examiner must document every person who handled the evidence from the moment it was seized until it is presented in court. What is this documentation called?

   • AAcquisition log
   • BIncident report
   • CChain of custody
   • DHash verification report
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a benefit of using sparse acquisition when handling large data sets?

   • AIt captures all data including deleted files
   • BIt speeds up the acquisition process by using parallel I/O
   • CIt automatically encrypts the data
   • DIt reduces the amount of data collected to only what is relevant
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A forensic examiner needs to acquire data from a remote server located in another city. The server is running and cannot be taken offline. The examiner has network access to the server. Which acquisition method is most appropriate?

   • APerform a sparse acquisition of specific files over the network.
   • BPerform a remote live acquisition using a forensic tool that supports network imaging.
   • CUse a logical acquisition over the network to copy active files.
   • DAsk the local administrator to power off the server and ship the hard drives.
   Reveal Solution Discussion Select an answer first