Data Acquisition and Duplication CHFI Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A forensic examiner acquires a hard drive from a crime scene and later testifies in court. The defense attorney challenges the admissibility of the evidence, claiming the drive could have been tampered with after seizure. Which documentation or process would best refute this claim?

   • AA screenshot of the drive's file system properties
   • BA list of the forensic tools installed on the examiner's workstation
   • CA detailed chain of custody log showing every person who handled the evidence and when
   • DA verbal statement from the examiner that no tampering occurred
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A system administrator copies a suspect's hard drive to another drive using the Windows 'copy' command, then hands it to a forensic examiner. The examiner refuses to analyze the copy. Why is the copy not acceptable as forensic evidence?

   • AThe copy is a logical file copy, not a bit-stream image, and may miss deleted files and metadata.
   • BThe copy was made using a non-forensic tool, so it is automatically invalid.
   • CThe copy was made without a write blocker, so the original drive was modified.
   • DThe copy is not compressed, so it is too large to be analyzed.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In which situation would a sparse acquisition be most beneficial?

   • AWhen the investigator only needs a few specific files from a very large server
   • BWhen the investigator needs to capture volatile memory
   • CWhen the investigator needs to recover deleted files from unallocated space
   • DWhen the investigator needs to capture the entire hard drive for court
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An examiner is investigating a case involving a 2 TB drive. The investigation only requires specific files from a particular folder, but the examiner is concerned about deleted files that may be relevant. The examiner has limited time and storage. Which acquisition strategy best balances the need for deleted files, time, and storage?

   • APerform a full physical acquisition of the entire drive
   • BPerform a sparse acquisition of only the specific folder
   • CPerform a logical acquisition of the specific folder and a sparse acquisition of the unallocated space
   • DPerform a live acquisition of the system memory
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An examiner is asked to provide a copy of a suspect's hard drive to the defense team. The examiner creates a bit-stream image of the drive and provides the image file. The defense team claims that the image is not a true duplicate because it is a single file. Which response is most accurate?

   • AThe image is not a duplicate because it is compressed and loses data
   • BThe image is not a duplicate because it does not include the drive's firmware
   • CThe bit-stream image is a valid forensic duplicate because it contains an exact copy of every sector of the drive
   • DThe image is not a duplicate because it is stored in a proprietary format
   Reveal Solution Discussion Select an answer first