An incident responder is responding to a breach on a live server. The responder needs to capture the current state of the system, including running processes and network connections, without taking the server offline. Which tool should the responder use?

A disk imaging tool such as FTK Imager

A memory acquisition tool such as DumpIt or WinPmem

A file recovery tool such as Recuva

Which of the following is an example of data that can only be acquired through live acquisition?

Deleted files in unallocated space

A forensic examiner must acquire a hard drive from a powered-off computer. The examiner needs to preserve the entire drive, including deleted files and unallocated space, to ensure no potential evidence is missed. Which imaging method should be used?

Physical imaging of the entire drive

Sparse imaging of the file system metadata

Live imaging of the system memory

Logical imaging of only the active files

In digital forensics, what is the primary purpose of data acquisition?

To delete irrelevant files from the suspect's device

To analyze the data in place without altering the original media

To create an exact, forensically sound copy of digital evidence for analysis

To recover deleted files from unallocated space

EC-CouncilDigital Forensics Essentials

Domain 2Objective 4

Types and Methods of Data Acquisition DFE Practice Questions (Page 5)

Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.

41questions here

9free pages

10concepts

Questions 21–25

21application · medium
An incident responder is responding to a breach on a live server. The responder needs to capture the current state of the system, including running processes and network connections, without taking the server offline. Which tool should the responder use?
Select an answer first
22foundation · easy
Which of the following is an example of data that can only be acquired through live acquisition?
Select an answer first
23foundation · easy
Which acquisition method is performed on a computer that is powered on and running?
Select an answer first
24application · medium
A forensic examiner must acquire a hard drive from a powered-off computer. The examiner needs to preserve the entire drive, including deleted files and unallocated space, to ensure no potential evidence is missed. Which imaging method should be used?
Select an answer first
25foundation · easy
In digital forensics, what is the primary purpose of data acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.