Data Acquisition and Duplication ECSS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An examiner is investigating a case where only a specific range of sectors on a hard drive is relevant. The examiner wants to capture only those sectors to save time and storage. Which acquisition method should be used?

   • ALogical acquisition of the entire drive.
   • BPhysical acquisition of the entire drive.
   • CSparse acquisition of the specific sector range.
   • DLive acquisition of the system's RAM.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A forensic examiner is acquiring evidence from a corporate server that is located in a different city. The examiner cannot be physically present, so a local IT administrator will perform the acquisition under the examiner's remote guidance. The evidence will be used in a legal proceeding. What is the most important consideration for the chain of custody?

   • AAsk the IT administrator to perform a live acquisition and email the image file to the examiner.
   • BHave the IT administrator take a photo of the server and send it to the examiner.
   • CHave the IT administrator use a hardware write blocker and then mail the original drive to the examiner.
   • DEnsure the IT administrator documents every action taken and that the examiner verifies the documentation and the integrity of the acquired image.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company's legal team needs to preserve evidence from a server that is still running critical services. The server cannot be shut down. The forensic team must acquire data without disrupting operations. What is the most appropriate acquisition strategy?

   • APerform a live acquisition of the server's memory and logical files.
   • BPerform a static acquisition of the server's hard drives.
   • CCreate a physical image of the server's drives while it is running.
   • DUse a hardware write blocker to image the drives without shutting down.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A forensic examiner needs to duplicate a 2 TB hard drive for analysis. The examiner wants to ensure the duplicate is an exact copy and that the process is documented for court. Which steps should the examiner take?

   • AUse FTK Imager to create a logical image, then compute an MD5 hash of the image.
   • BUse a file copy command to copy all files to a new drive, then compare file sizes.
   • CUse dd to create a raw image, compute a SHA-256 hash of the original and the image, and document the process in a chain-of-custody form.
   • DUse Guymager to create a sparse image, then compare the hash of the image to the original drive's hash.
   Reveal Solution Discussion Select an answer first
6. 25application · easy

   A forensic examiner creates an image of a hard drive using FTK Imager and computes a SHA-1 hash of the image. Later, the examiner needs to verify that the image has not been altered. What should the examiner do?

   • AOpen the image in FTK Imager and visually inspect the files.
   • BRecompute the SHA-1 hash of the image and compare it to the original hash.
   • CCheck the file size of the image to ensure it matches the original.
   • DCompare the image to the original drive using a different tool.
   Reveal Solution Discussion Select an answer first