What does a bit-stream image of a storage medium contain?

An exact copy of every bit on the medium, including deleted files and slack space

Only the active files and folders on the medium

A list of all files with their metadata

A compressed archive of all user-created documents

What is the primary characteristic of a sparse acquisition?

It captures only specific data ranges or files of interest, leaving out unneeded areas

It captures the entire physical disk including all slack space

It captures only the active files and folders

It captures only the metadata of files

What is the key difference between data duplication and forensic imaging?

Data duplication creates a bit-for-bit copy, while forensic imaging copies only active files

Data duplication includes hashing, while forensic imaging does not

Data duplication is faster than forensic imaging

Data duplication is used for backup, while forensic imaging is used for evidence preservation

A forensic examiner responds to an active ransomware incident at a hospital. The IT team has isolated the infected server but it is still running. The examiner needs to preserve volatile data (running processes, network connections) and then capture the disk. What is the most appropriate acquisition strategy?

Perform a live acquisition of RAM first, then a static bit-stream image of the disk.

Use a network-based remote acquisition tool to capture the disk without touching the server.

Power off the server immediately and perform a static acquisition of the disk.

Perform a logical acquisition of the disk and skip RAM because the server is still running.

EC-CouncilComputer Hacking Forensic Investigator

Domain 2Objective 2

Data Acquisition and Duplication CHFI Practice Questions (Page 9)

Part of the Storage Media, Acquisition and Anti-Forensics domain, which makes up ~18% of our current practice bank.

56questions here

12free pages

14concepts

Questions 41–45

41foundation · easy
What does a bit-stream image of a storage medium contain?
Select an answer first
42foundation · easy
What is the primary characteristic of a sparse acquisition?
Select an answer first
43foundation · easy
What is the key difference between data duplication and forensic imaging?
Select an answer first
44application · medium
A forensic examiner responds to an active ransomware incident at a hospital. The IT team has isolated the infected server but it is still running. The examiner needs to preserve volatile data (running processes, network connections) and then capture the disk. What is the most appropriate acquisition strategy?
Select an answer first
45foundation · easy
Which hashing algorithm is commonly used in forensic imaging to verify integrity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Data Acquisition and Duplication CHFI Practice Questions (Page 9)

Questions 41–45

What does a bit-stream image of a storage medium contain?

What is the primary characteristic of a sparse acquisition?

What is the key difference between data duplication and forensic imaging?

Which hashing algorithm is commonly used in forensic imaging to verify integrity?

Keep studying — Storage Media, Acquisition and Anti-Forensics