A forensic examiner is acquiring a drive from a legacy system that uses a file system not recognized by the examiner's forensic software. The examiner needs to preserve the entire drive for later analysis, but the software only supports DD and E01. The examiner has limited time and storage. Which approach should the examiner take?

Create an E01 image and rely on its embedded hash

Use a proprietary format from the forensic software

Create a DD image and compute a separate hash for verification

Perform a logical acquisition of recognized files

EC-CouncilDigital Forensics Essentials

Domain 2Objective 5

Forensic Image Formats and Standards DFE Practice Questions (Page 5)

Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.

22questions here

5free pages

4concepts

Questions 21–22

21expert · hard
A forensic examiner is acquiring a drive from a legacy system that uses a file system not recognized by the examiner's forensic software. The examiner needs to preserve the entire drive for later analysis, but the software only supports DD and E01. The examiner has limited time and storage. Which approach should the examiner take?
Select an answer first
22application · medium
An examiner is comparing E01 and AFF for a case. The examiner values the ability to add custom metadata fields and the format's openness. However, the examiner also needs to ensure the image can be read by a wide range of commercial forensic tools. Which format should the examiner choose?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Forensic Image Formats and Standards DFE Practice Questions (Page 5)

Questions 21–22

An examiner is comparing E01 and AFF for a case. The examiner values the ability to add custom metadata fields and the format's openness. However, the examiner also needs to ensure the image can be read by a wide range of commercial forensic tools. Which format should the examiner choose?

Keep studying — Storage Media and Data Acquisition