Data Acquisition and Duplication ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic examiner is using the dd command in Linux to create an image of a hard drive. The examiner wants to ensure the image is created without modifying the original drive. What should the examiner do?

   • AUse a hardware write blocker and specify the correct input and output devices in the dd command.
   • BMount the drive as read-only and then use dd.
   • CUse dd to copy the drive to another drive without a write blocker.
   • DUse dd with the 'conv=noerror' option to skip errors.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which acquisition method copies only the files and folders that are currently allocated and accessible by the file system?

   • APhysical acquisition
   • BLive acquisition
   • CSparse acquisition
   • DLogical acquisition
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic examiner is imaging a hard drive that is connected to a forensic workstation. The examiner notices that the drive is making unusual clicking sounds and suspects a hardware failure. The examiner wants to maximize the chance of recovering data while preserving the integrity of the evidence. Which approach should the examiner take?

   • AUse a software write blocker and then use Guymager to create a sparse image of the drive.
   • BUse dd with 'conv=noerror,sync' to continue reading past bad sectors and create a raw image, then hash the image.
   • CUse a hardware write blocker and then use FTK Imager to create a logical image of the drive.
   • DPower off the drive immediately and send it to a data recovery specialist.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a primary advantage of using the Advanced Forensic Format (AFF) over raw (DD) images?

   • AAFF supports metadata and compression, while raw images do not
   • BAFF images are always smaller than raw images
   • CAFF is the only format that can be read by all forensic tools
   • DAFF images cannot be hashed, while raw images can
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A forensic examiner has created a raw (DD) image of a suspect's drive and an E01 image of the same drive. The examiner wants to verify that both images contain the same data. The examiner has the original drive still available. Which verification method is most reliable?

   • AUse the E01 image's embedded hash as the definitive verification for both images.
   • BCompute the SHA-256 hash of the original drive and compare it to the hash of the raw image, then verify the E01 image's embedded hash.
   • COpen both images in a hex editor and visually compare the first few sectors.
   • DCompare the file sizes of the raw image and the E01 image.
   Reveal Solution Discussion Select an answer first