Which technique is commonly used during the analysis phase to recover deleted files from a forensic image?

Decrypting the entire drive with a brute-force attack

Running a full antivirus scan on the forensic image

Rebuilding the RAID array from the original drives

Carving based on file signatures

A forensic analyst is acquiring the hard drive of a server that is still running critical services. The analyst needs to minimize disruption while preserving evidence. Which approach is most appropriate?

Use the server's backup software to create a backup

Copy the files over the network to a forensic server

Shut down the server and remove the hard drive for imaging

Perform a live acquisition using a forensic tool that captures the disk while the system is running

A forensic examiner is acquiring a hard drive from a suspect's computer. The examiner uses a hardware write-blocker and creates a forensic image. Later, the examiner computes a hash of the original drive and the image. Why is this hash comparison performed?

To determine the file system type of the original drive

To compress the image to save storage space

To encrypt the image so that it cannot be read by unauthorized users

To verify that the image is an exact copy of the original drive

What is the primary purpose of maintaining a chain of custody document during the collection and acquisition of digital evidence?

To record every person who handled the evidence and the times of transfer, ensuring the evidence's integrity and admissibility

To provide a detailed analysis of the evidence's content

To list all the software tools used during the acquisition process

To secure the evidence in a locked container

EC-CouncilCertified Security Specialist

Domain 5Objective 2

Computer Forensics Investigation Process ECSS Practice Questions (Page 9)

Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.

44questions here

9free pages

5concepts

Questions 41–44

41foundation · easy
Which technique is commonly used during the analysis phase to recover deleted files from a forensic image?
Select an answer first
42application · medium
A forensic analyst is acquiring the hard drive of a server that is still running critical services. The analyst needs to minimize disruption while preserving evidence. Which approach is most appropriate?
Select an answer first
43application · medium
A forensic examiner is acquiring a hard drive from a suspect's computer. The examiner uses a hardware write-blocker and creates a forensic image. Later, the examiner computes a hash of the original drive and the image. Why is this hash comparison performed?
Select an answer first
44foundation · easy
What is the primary purpose of maintaining a chain of custody document during the collection and acquisition of digital evidence?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.