Data Acquisition and Duplication ECSS Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What does it indicate if the hash value of an acquired forensic image matches the hash value of the original storage media?

   • AThe image contains no deleted files
   • BThe image is compressed and ready for analysis
   • CThe image has been encrypted with a strong algorithm
   • DThe image is an exact duplicate of the original data
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An incident responder is called to a small office where an employee is suspected of leaking sensitive documents. The employee's workstation is powered on and the user is actively working. The responder needs to preserve volatile data and capture the system state without shutting it down. Which acquisition approach should the responder use?

   • APerform a sparse acquisition of the entire hard drive while the system is running.
   • BCreate a physical image of the hard drive without interacting with the running system.
   • CPerform a live acquisition, capturing RAM and running processes, then create a logical image of open files.
   • DPower off the system immediately and perform a static acquisition of the hard drive using a write blocker.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is data acquisition considered a critical first step in a digital forensics investigation?

   • AIt ensures that the original evidence remains unaltered and can be used for verification
   • BIt reduces the storage space required for evidence by compressing the data
   • CIt converts data into a human-readable format for easier review
   • DIt allows investigators to immediately identify the perpetrator of a cybercrime
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A forensic examiner is investigating a case involving a large RAID server. The server is still running, and the examiner needs to preserve evidence without disrupting the business. The RAID array is critical and cannot be taken offline. The examiner needs to acquire data that includes active files and deleted files that may still be present in unallocated space. Which acquisition approach should the examiner use?

   • APower down the server and perform a physical acquisition of each drive in the RAID array.
   • BPerform a live acquisition of memory only, as it contains all relevant evidence.
   • CPerform a live logical acquisition of active files and a sparse acquisition of unallocated space.
   • DPerform a physical acquisition of the entire RAID array while it is running.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A junior forensic examiner is asked to create a forensic image of a USB drive that is connected to a forensic workstation. The examiner wants to use a tool that can create a raw image and also compute a hash of the image in one step. Which tool should the examiner use?

   • AUse dd with the 'conv=noerror,sync' option and pipe the output to a hashing tool like sha256sum.
   • BUse a hardware write blocker and then copy the files manually to a folder.
   • CUse Guymager to create an image but skip hashing because Guymager does not support it.
   • DUse FTK Imager to create a logical image of the USB drive.
   Reveal Solution Discussion Select an answer first