Types and Methods of Data Acquisition DFE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An examiner is investigating a large RAID array where the relevant evidence is spread across multiple specific files. The array is too large to image entirely within the available time and storage capacity. The examiner must decide between sparse acquisition and logical acquisition. Which factor most strongly favors sparse acquisition over logical acquisition?

   • ASparse acquisition produces a smaller image than logical acquisition
   • BSparse acquisition can capture data from unallocated space and file fragments
   • CSparse acquisition is faster than logical acquisition
   • DSparse acquisition does not require a write-blocker
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is write protection important during data acquisition?

   • ATo capture volatile data
   • BTo allow the system to remain operational
   • CTo speed up the acquisition process
   • DTo prevent any modification to the original evidence
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A forensic examiner needs to collect only the emails and chat logs from a suspect's computer that is currently running. The examiner wants to minimize the amount of data collected while ensuring the selected files are preserved. Which acquisition method is most appropriate?

   • ASparse acquisition of the unallocated space
   • BPhysical acquisition of the entire hard drive
   • CLogical acquisition of the email and chat files
   • DLive acquisition of the system memory
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of using a write blocker during forensic acquisition?

   • ATo allow the system to boot from the evidence drive
   • BTo prevent the operating system from writing data to the evidence drive
   • CTo increase the speed of data transfer
   • DTo encrypt the evidence drive
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An incident responder discovers that a critical server is still running and contains volatile data, including active network connections and running processes. The organization requires that the server remain online to continue providing services. Which acquisition approach should the responder use?

   • AUse a write-blocker and create a physical image of the running system's memory.
   • BPerform a live acquisition to capture volatile data and a logical image of selected files.
   • CCreate a sparse image of the server's hard drive to preserve only active files.
   • DShut down the server and perform a static acquisition of the hard drive.
   Reveal Solution Discussion Select an answer first