Types and Methods of Data Acquisition DFE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which statement best defines data acquisition in the context of digital forensics?

   • AThe process of collecting and preserving digital evidence in a forensically sound manner
   • BThe process of presenting digital evidence in a court of law
   • CThe process of analyzing digital evidence to extract actionable intelligence
   • DThe process of securely erasing digital evidence from a storage device
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a commonly used tool for data acquisition in digital forensics?

   • ANmap
   • BFTK Imager
   • CWireshark
   • DMetasploit
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A forensic examiner is acquiring a hard drive from a seized computer. The examiner connects the drive to a forensic workstation using a hardware write-blocker. During the acquisition, the examiner notices that the write-blocker is not functioning correctly and the drive is being mounted as read-write by the operating system. What should the examiner do?

   • AStop the acquisition immediately, disconnect the drive, and use a different write-blocker or a forensic tool that supports software write protection.
   • BDisconnect the drive and connect it directly to the forensic workstation without a write-blocker.
   • CContinue the acquisition, as the drive is being read and the data is being captured.
   • DUse the operating system's built-in write protection feature to prevent writes.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A corporate investigator needs to collect only the emails and chat logs from an employee's laptop for a policy violation investigation. The laptop is currently running, and the investigator wants to minimize disruption to the employee's work. The company policy requires that the collected data be verifiable. Which acquisition method is most appropriate?

   • APerform a live acquisition of the system memory to capture the emails and chat logs from RAM.
   • BCreate a sparse image of the entire hard drive, focusing on the areas where the email and chat files are stored.
   • CPerform a logical acquisition of the specific email and chat application data files while the system is running.
   • DPower off the laptop, remove the hard drive, and create a full physical image.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A forensic examiner is called to a scene where a computer is still running and the suspect may have encrypted files. The examiner needs to preserve evidence while minimizing changes to the system. Which acquisition approach should be used first?

   • AImmediately shut down the computer and perform a static acquisition
   • BCreate a sparse image of the hard drive
   • CPerform a logical acquisition of the encrypted files only
   • DPerform a live acquisition to capture volatile data and memory
   Reveal Solution Discussion Select an answer first