A forensic examiner needs to create a bit-for-bit image of a suspect's SATA hard drive. The drive is known to be in a write-protected state, but the examiner wants to ensure no data is altered during acquisition. Which tool should be used to connect the drive to the forensic workstation?

A USB-to-SATA adapter without write protection.

A hardware write blocker between the suspect drive and the forensic workstation.

A software write blocker installed on the suspect machine.

A network share mapped to the suspect drive.

Which of the following is a key difference between hardware and software write blockers?

Hardware write blockers operate at the physical interface level, while software write blockers operate at the operating system level

Hardware write blockers can only be used on SATA drives, while software write blockers work on all interfaces

Software write blockers are physical devices that connect between the drive and the computer

Software write blockers are always more reliable than hardware write blockers

Why are cryptographic hashes such as MD5, SHA-1, and SHA-256 used during data acquisition?

To compress the image to reduce storage space

To verify that the acquired image is an exact copy of the original data

To encrypt the acquired image so that only authorized investigators can view it

To recover deleted files from the acquired image

When is static (dead) acquisition most appropriate in a digital forensics investigation?

When the computer is powered off and the storage media can be safely removed

When the system is running and volatile data must be captured

When the system is encrypted and the decryption key is not available

When the system is a server that cannot be taken offline

EC-CouncilCertified Security Specialist

Domain 5Objective 4

Data Acquisition and Duplication ECSS Practice Questions (Page 6)

Part of the Digital Forensics Fundamentals and Acquisition domain, which makes up ~12% of our current practice bank.

43questions here

9free pages

9concepts

Questions 26–30

26foundation · easy
Which forensic acquisition tool is known for its graphical interface and ability to create images in multiple formats, including E01 and raw?
Select an answer first
27application · medium
A forensic examiner needs to create a bit-for-bit image of a suspect's SATA hard drive. The drive is known to be in a write-protected state, but the examiner wants to ensure no data is altered during acquisition. Which tool should be used to connect the drive to the forensic workstation?
Select an answer first
28foundation · easy
Which of the following is a key difference between hardware and software write blockers?
Select an answer first
29foundation · easy
Why are cryptographic hashes such as MD5, SHA-1, and SHA-256 used during data acquisition?
Select an answer first
30foundation · easy
When is static (dead) acquisition most appropriate in a digital forensics investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.