An examiner needs to acquire only the active files from a suspect's USB drive to quickly check for specific documents, while preserving the ability to verify the acquired data later. The drive is small and time is limited. Which acquisition method and integrity check should be used?

Logical acquisition of active files, followed by hashing the acquired data with SHA-256.

Physical acquisition of the entire drive, followed by hashing the original drive with MD5.

Live acquisition of the USB drive while it is connected to the suspect's computer, followed by hashing the live data.

Sparse acquisition of only the file slack space, followed by hashing the slack space data.

When would a forensic examiner choose a sparse acquisition over a physical acquisition?

When the system is running and volatile memory must be captured

When the device is too large to be imaged at all

When the entire storage device must be imaged including unallocated space

When only specific files or data ranges are needed and time is limited

A forensic examiner is about to image a SATA hard drive from a seized computer. The examiner wants to ensure that no data on the original drive is modified during the acquisition and that the resulting image is verifiable. Which combination of tools and procedures should be used?

Connect the drive through a hardware write blocker and create a raw image using dd, then compute a SHA-256 hash of the image.

Use Guymager to create a sparse image of the drive, then compare the file sizes of the original and the image.

Boot the seized computer and use a software write blocker to image the drive while the operating system is running.

Connect the drive directly to the forensic workstation and use FTK Imager to create a logical image of the drive.

A forensic examiner has created an E01 image of a suspect's drive. The examiner wants to verify that the image has not been corrupted during storage. Which feature of the E01 format should the examiner use?

The embedded CRC32 and MD5 hash values stored in the E01 file.

The compression ratio of the E01 image.

The file size of the E01 image compared to the original drive size.

The timestamp of the E01 file creation.

Which of the following should be documented in a chain of custody record during the acquisition process?

The personal opinions of the examiner about the case

The date, time, and location of the acquisition, along with the name of the person performing it

The weather conditions at the time of acquisition

The brand and model of the forensic workstation used

EC-CouncilCertified Security Specialist

Domain 5Objective 4

Data Acquisition and Duplication ECSS Practice Questions (Page 1)

Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.

43questions here

9free pages

9concepts

Questions 1–5

1application · medium
An examiner needs to acquire only the active files from a suspect's USB drive to quickly check for specific documents, while preserving the ability to verify the acquired data later. The drive is small and time is limited. Which acquisition method and integrity check should be used?
Select an answer first
2foundation · easy
When would a forensic examiner choose a sparse acquisition over a physical acquisition?
Select an answer first
3application · medium
A forensic examiner is about to image a SATA hard drive from a seized computer. The examiner wants to ensure that no data on the original drive is modified during the acquisition and that the resulting image is verifiable. Which combination of tools and procedures should be used?
Select an answer first
4application · medium
A forensic examiner has created an E01 image of a suspect's drive. The examiner wants to verify that the image has not been corrupted during storage. Which feature of the E01 format should the examiner use?
Select an answer first
5foundation · easy
Which of the following should be documented in a chain of custody record during the acquisition process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.