A forensic examiner has created a physical image of a suspect's hard drive. The examiner needs to verify that the image is an exact copy of the original. Which of the following is the most reliable method for verification?

Check the timestamp of the image file to ensure it was created during the acquisition.

Compute the SHA-256 hash of the original drive and the image, and compare the values.

Open the image in a forensic tool and visually inspect the files.

Compare the file sizes of the original drive and the image.

Which method is commonly used to verify the integrity of acquired forensic data?

Checking the file size of the copy

Hashing the original and the copy and comparing the values

Using antivirus software to scan the copy

Comparing the modification dates of the files

Which scenario best illustrates the use of sparse acquisition?

Collecting only the deleted files from unallocated space

Creating a full image of a hard drive for a complete investigation

Copying all files from a user's folder

Capturing RAM from a running system

An examiner has created a forensic image of a suspect's drive. The examiner wants to ensure that the image is admissible in court. Which step is most critical to demonstrate the integrity of the evidence?

Perform a logical acquisition of the drive

Store the image on a write-protected medium

Document the hash values of the original drive and the image

Use a write-blocker during the acquisition

An examiner is investigating a large server drive where the relevant evidence is scattered across several specific files. The drive is too large to image entirely within the available time. Which acquisition method should the examiner use to collect the relevant data efficiently?

Logical acquisition of the file system metadata

Physical acquisition of the entire drive

Live acquisition of the system memory

Sparse acquisition of the specific files and relevant data regions

EC-CouncilDigital Forensics Essentials

Domain 2Objective 4

Types and Methods of Data Acquisition DFE Practice Questions (Page 2)

Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.

41questions here

9free pages

10concepts

Questions 6–10

6application · easy
A forensic examiner has created a physical image of a suspect's hard drive. The examiner needs to verify that the image is an exact copy of the original. Which of the following is the most reliable method for verification?
Select an answer first
7foundation · easy
Which method is commonly used to verify the integrity of acquired forensic data?
Select an answer first
8foundation · easy
Which scenario best illustrates the use of sparse acquisition?
Select an answer first
9expert · hard
An examiner has created a forensic image of a suspect's drive. The examiner wants to ensure that the image is admissible in court. Which step is most critical to demonstrate the integrity of the evidence?
Select an answer first
10application · medium
An examiner is investigating a large server drive where the relevant evidence is scattered across several specific files. The drive is too large to image entirely within the available time. Which acquisition method should the examiner use to collect the relevant data efficiently?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.