Types and Methods of Data Acquisition DFE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A forensic examiner is preparing to image a hard drive that is connected to a forensic workstation. The examiner is concerned about the integrity of the evidence and wants to ensure that the original drive is not modified. Which combination of actions is most effective?

   • ABoot the original drive to ensure it is readable
   • BUse a software write-blocker and skip hash verification
   • CUse a logical acquisition tool to copy active files
   • DUse a hardware write-blocker and verify the image with a hash
   Reveal Solution Discussion Select an answer first
2. 17application · easy

   A forensic examiner is acquiring a hard drive from a computer that was involved in a fraud case. The computer is powered off. The examiner needs to ensure the evidence is not modified during the acquisition. Which of the following is the most important step?

   • AConnect the drive directly to the forensic workstation without a write-blocker.
   • BUse a software write-blocker to connect the drive to the forensic workstation.
   • CUse a hardware write-blocker to connect the drive to the forensic workstation.
   • DBoot the computer and use the operating system to copy the files.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An examiner is investigating a large 4 TB server drive. The case only involves a specific set of files located in a known directory, and the examiner wants to minimize the time and storage required for the acquisition. The examiner must ensure the collected data is verifiable. Which acquisition method is the most efficient and appropriate?

   • APerform a live acquisition of the system memory to capture the relevant files.
   • BPerform a full physical image of the entire 4 TB drive.
   • CPerform a sparse acquisition, collecting only the data blocks associated with the files in the known directory.
   • DPerform a logical acquisition of the entire filesystem, including all user files.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is live acquisition necessary in digital forensics?

   • ATo create a bit-for-bit copy of the hard drive without powering off the system
   • BTo ensure the system remains available to users
   • CTo capture volatile data that would be lost when the system is powered off
   • DTo avoid the need for write protection
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   After creating a forensic image of a suspect's hard drive, the examiner needs to ensure the image is an exact copy of the original. Which procedure is the most reliable method for verifying the integrity of the acquired image?

   • ACompare the file sizes of the original drive and the acquired image.
   • BCompute a hash value (e.g., SHA-256) of the original drive and the acquired image, and compare the two values.
   • COpen the image in a forensic tool and visually inspect the files.
   • DCheck the timestamp of the image file to ensure it was created during the acquisition.
   Reveal Solution Discussion Select an answer first