A forensic examiner is investigating a case where the relevant evidence is in specific files, but the examiner also needs to check for deleted data in the unallocated space of the same drive. The drive is large, and time is limited. Which acquisition strategy is most efficient?

Perform a physical acquisition of the entire drive

Perform a logical acquisition of the specific files and ignore unallocated space

Perform a sparse acquisition of the specific files and the unallocated space

Perform a live acquisition of the system memory

A forensic examiner receives a seized laptop that was powered off at the scene. The laptop contains a single SATA drive. The examiner must preserve the entire drive for analysis. Which procedure best ensures the integrity of the evidence?

Boot the laptop to a forensic live CD, connect to the network, and copy the drive contents to a network share.

Create a sparse image of the drive by copying only the allocated file system blocks.

Power on the laptop and use a logical acquisition tool to copy only user documents and emails.

Remove the drive, connect it to a write-blocker, and create a bit-for-bit image of the entire drive.

What is the primary advantage of static acquisition?

It is faster than live acquisition

It captures volatile data like RAM

It allows the system to remain operational during the acquisition

It preserves the exact state of the storage media without alteration

A forensic examiner is about to image a suspect's hard drive using a forensic workstation. To ensure the original drive is not altered during the acquisition, which step is essential?

Boot the suspect's operating system to verify the drive

Connect the drive through a write-blocker

Use a logical acquisition tool to copy active files

Perform a live acquisition of the system memory

An examiner is acquiring evidence from a computer that was used to download illegal content. The examiner needs to recover deleted files and also analyze the file system structure. The examiner has a hardware write-blocker and a forensic tool that can create both physical and logical images. Which approach is the most comprehensive for this investigation?

Create a physical image of the drive, which captures the entire drive including unallocated space, and then analyze the image for deleted files.

Create a sparse image of the drive, focusing on the areas where deleted files are likely to be.

Create a live image of the system memory to capture the deleted files.

Create a logical image of the drive, which captures only the active files and folders.

EC-CouncilDigital Forensics Essentials

Domain 2Objective 4

Types and Methods of Data Acquisition DFE Practice Questions (Page 8)

Part of the Storage Media and Data Acquisition domain, which makes up ~12% of our current practice bank.

41questions here

9free pages

10concepts

Questions 36–40

36expert · hard
A forensic examiner is investigating a case where the relevant evidence is in specific files, but the examiner also needs to check for deleted data in the unallocated space of the same drive. The drive is large, and time is limited. Which acquisition strategy is most efficient?
Select an answer first
37application · medium
A forensic examiner receives a seized laptop that was powered off at the scene. The laptop contains a single SATA drive. The examiner must preserve the entire drive for analysis. Which procedure best ensures the integrity of the evidence?
Select an answer first
38foundation · easy
What is the primary advantage of static acquisition?
Select an answer first
39application · medium
A forensic examiner is about to image a suspect's hard drive using a forensic workstation. To ensure the original drive is not altered during the acquisition, which step is essential?
Select an answer first
40expert · medium
An examiner is acquiring evidence from a computer that was used to download illegal content. The examiner needs to recover deleted files and also analyze the file system structure. The examiner has a hardware write-blocker and a forensic tool that can create both physical and logical images. Which approach is the most comprehensive for this investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.