Data Acquisition and Duplication ECSS Practice Questions (Page 9)

Questions 41–43

1. 41application · medium

   An examiner needs to duplicate a solid-state drive (SSD) from a suspect's laptop. The SSD is connected via a hardware write blocker. The examiner wants to ensure the duplicate is exact and the process is documented. What should the examiner do?

   • ACreate a sparse image of the drive and skip hashing.
   • BUse a software write blocker and create a logical image of the drive.
   • CCreate a bit-for-bit image using a forensic tool, compute a hash of the original and the image, and document the process.
   • DCopy the entire drive to another SSD using Windows copy and paste.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A forensic examiner has created a bit-for-bit duplicate of a suspect's hard drive using dd. Before the duplicate is used for analysis, the examiner must confirm that the duplicate exactly matches the original. Which procedure should the examiner follow?

   • AOpen the duplicate in a hex editor and visually compare a few sectors with the original.
   • BCompute a SHA-256 hash of the original drive and the duplicate, and compare the hash values.
   • CRun a file system check on the duplicate to ensure it is bootable.
   • DCompare the file sizes of the original drive and the duplicate.
   Reveal Solution Discussion Select an answer first
3. 43foundation · easy

   Which forensic image format is known for its ability to store metadata, such as case notes and hash values, alongside the acquired data?

   • AE01 (Expert Witness Format)
   • BRaw (DD) format
   • CVHD (Virtual Hard Disk) format
   • DISO format
   Reveal Solution Discussion Select an answer first