Disk Drive Types and Logical Structure of a Disk DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic examiner is acquiring evidence from a computer that has been running for several days. The examiner needs to capture the system's volatile memory as well as the disk. Which of the following is the most important consideration when performing a live acquisition?

   • AThe system should be shut down immediately to preserve evidence.
   • BThe disk should be acquired first to avoid data loss.
   • CThe order of volatility should be followed, capturing memory before disk.
   • DThe acquisition should be performed using a hardware write blocker.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A forensic examiner must acquire a laptop that has a 512 GB NVMe SSD. The laptop is running Windows 10 with BitLocker enabled. The examiner has the BitLocker recovery key. The laptop is currently powered on and the user is logged in. The examiner wants to create a forensic image that includes the unallocated space. Which approach is most appropriate?

   • ASuspend BitLocker, then perform a physical acquisition of the SSD using a hardware write blocker, and then resume BitLocker.
   • BPerform a logical acquisition of the mounted BitLocker volume while the system is running, using a software tool that can read the decrypted data.
   • CUse the BitLocker recovery key to unlock the drive, then perform a logical acquisition of the entire volume, including unallocated space, using a forensic tool that can read the raw volume.
   • DPerform a physical acquisition of the SSD using a hardware write blocker after shutting down the laptop and removing the drive.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic examiner is acquiring evidence from a laptop that has an SSD. The examiner is concerned about the TRIM command and its effect on deleted data. Which of the following is the most accurate statement regarding TRIM and forensic acquisition?

   • ATRIM only affects HDDs, not SSDs.
   • BTRIM can cause deleted data to be unrecoverable because the SSD may erase blocks.
   • CTRIM permanently erases data immediately upon deletion.
   • DTRIM has no impact on forensic acquisition.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is it important for a forensic examiner to know whether a suspect drive is an SSD or an HDD before performing data acquisition?

   • AHDDs store data in a compressed format that must be decompressed before imaging
   • BHDDs cannot be imaged without removing the platters
   • CSSDs use wear-leveling and TRIM, which can permanently erase data that the operating system has marked for deletion, so imaging must be done carefully and promptly
   • DSSDs require a special file system to be imaged
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In the logical structure of a disk, what is a cluster?

   • AA group of tracks that are the same distance from the center of the platter
   • BThe smallest unit of storage that the operating system can allocate to a file
   • CA single physical sector on the disk platter
   • DThe entire set of tracks on one side of a platter
   Reveal Solution Discussion Select an answer first