EC-CouncilDigital Forensics Essentials
Domain 2Objective 5
Forensic Image Formats and Standards DFE Practice Questions (Page 2)
Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.
22questions here
5free pages
4concepts
Questions 6–10
- 6
A forensic examiner is acquiring a small solid-state drive (SSD) from a suspect's laptop. The examiner needs to preserve the exact state of the drive, including unallocated space, and must ensure the image is admissible in court. The examiner has limited storage space. Which format should the examiner use?
Select an answer first - 7
A forensic examiner needs to acquire a large hard drive and wants to minimize storage space while preserving the ability to verify the integrity of the image. Which format is most appropriate for this scenario?
Select an answer first - 8
A forensic tool vendor wants to ensure its new acquisition software can read images created by other tools that follow the Expert Witness Format specification. What should the vendor implement to achieve this?
Select an answer first - 9
Which forensic image format is known for its open-source nature, support for compression, and ability to store metadata in a flexible, extensible way, making it a popular choice for interoperability?
Select an answer first - 10
A forensic examiner is acquiring a drive from a Mac computer. The examiner needs to preserve the exact byte-for-byte copy of the drive, including the HFS+ file system and any deleted files. The examiner does not need compression or metadata. Which format should the examiner use?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.