Types and Methods of Data Acquisition DFE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which imaging method would capture deleted files and unallocated space?

   • ASparse imaging
   • BLogical imaging
   • CPhysical imaging
   • DLive imaging
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A forensic examiner receives a computer that was found powered off at a crime scene. The examiner must preserve the evidence in a way that allows for later analysis of deleted files. Which acquisition method should be used?

   • ALive acquisition of the system memory
   • BLogical acquisition of active files only
   • CSparse acquisition of the file system metadata
   • DStatic acquisition using a physical imaging tool
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   An incident response team is investigating a compromised web server that is still running. The team needs to capture the current state of the system, including running processes, network connections, and the contents of memory. Which type of acquisition should the team perform?

   • ALive acquisition, which captures volatile data from the running system.
   • BStatic acquisition, which requires powering off the system first.
   • CLogical acquisition, which captures specific files from the filesystem.
   • DSparse acquisition, which captures only selected data blocks.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which command-line tool is commonly used in Linux for creating a forensic image of a storage device?

   • Atcpdump
   • Bgrep
   • Cdd
   • Dchmod
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the key difference between physical and logical imaging?

   • APhysical imaging is faster than logical imaging
   • BPhysical imaging requires the system to be powered on, while logical imaging requires it to be off
   • CPhysical imaging captures the entire storage device bit by bit, while logical imaging captures specific files or folders
   • DLogical imaging captures deleted files, while physical imaging does not
   Reveal Solution Discussion Select an answer first