Types and Methods of Data Acquisition DFE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In which scenario would logical acquisition be most appropriate?

   • AWhen the system is powered off and volatile data is needed
   • BWhen only specific files are needed for the investigation
   • CWhen the storage device is damaged and cannot be read
   • DWhen the entire hard drive needs to be imaged for a complete analysis
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which acquisition method focuses on collecting only specific files or folders rather than the entire storage device?

   • ALive acquisition
   • BSparse acquisition
   • CStatic acquisition
   • DLogical acquisition
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What does sparse acquisition collect?

   • AAll files in a logical partition
   • BVolatile memory from a running system
   • CThe entire physical storage device bit by bit
   • DOnly specific data fragments or files of interest
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A forensic examiner needs to acquire evidence from a seized laptop. The investigation requires recovering deleted files and analyzing the unallocated space. The examiner also needs to verify that the acquired data matches the original drive. Which imaging method should the examiner use?

   • APhysical imaging, which captures the entire drive bit-for-bit, including unallocated space, and then verify with a hash of the image.
   • BSparse imaging, which captures only the data blocks associated with active files.
   • CLive imaging, which captures the system memory and running processes.
   • DLogical imaging, which captures only the active files and folders on the drive.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After creating a forensic image of a suspect's drive, the examiner must verify that the image is an exact copy of the original. Which method should the examiner use to confirm the integrity of the acquired image?

   • AConfirm the image was created using a logical acquisition tool
   • BCheck the file timestamps of the image files
   • CEnsure the image file is stored on a write-protected medium
   • DCompare the hash values of the original drive and the image
   Reveal Solution Discussion Select an answer first