CHFI Data Acquisition and Duplication 2 — Questions and Answers
Question 1: Which acquisition method captures only the allocated, in-use clusters on a drive rather than every sector?
- Sparse acquisition
- Logical acquisition (Correct answer)
- Live acquisition
- Targeted acquisition
Correct answer: Logical acquisition
Logical acquisition copies only the active file system contents (allocated clusters), not unallocated space or slack space.
Question 2: A suspect's laptop uses full-disk BitLocker encryption and is found powered ON. What is the BEST immediate action to preserve decrypted data?
- Shut it down immediately to prevent data changes
- Perform a live RAM acquisition before powering off (Correct answer)
- Remove the drive and image it in a write blocker
- Wait for BitLocker to time out and re-encrypt
Correct answer: Perform a live RAM acquisition before powering off
Performing a live RAM acquisition captures the BitLocker encryption keys stored in volatile memory before the machine is powered off.
Question 3: In the dd command 'dd if=/dev/sda of=/mnt/evidence/disk.img bs=512 conv=noerror,sync', what does the 'sync' option do?
- Forces synchronous writes to prevent buffering
- Pads bad blocks with zeros to maintain image size integrity (Correct answer)
- Skips read errors silently
- Syncs the image hash after completion
Correct answer: Pads bad blocks with zeros to maintain image size integrity
The 'sync' option pads every failed read block with null bytes so the output image remains the same size as the source, preserving offset alignment.
Question 4: Which of the following is a PRIMARY advantage of using EnCase's E01 format over a raw dd image?
- E01 images are always smaller due to mandatory compression
- E01 embeds case metadata and a hash for integrity verification within the file (Correct answer)
- E01 images can be mounted natively by all Linux distributions
- E01 format does not require a write blocker during acquisition
Correct answer: E01 embeds case metadata and a hash for integrity verification within the file
The E01 (Expert Witness) format stores case metadata, examiner notes, and MD5/SHA-1 hashes inside the image container itself for built-in integrity verification.
Question 5: What distinguishes a 'selective' acquisition from a 'full physical' acquisition?
- Selective acquisition copies every bit of the drive including HPA
- Selective acquisition targets specific files or folders based on relevance criteria (Correct answer)
- Selective acquisition uses hardware write blockers exclusively
- Selective acquisition always produces a compressed output
Correct answer: Selective acquisition targets specific files or folders based on relevance criteria
Selective acquisition collects only specific, forensically relevant files or directories rather than imaging the entire drive.
Question 6: A forensic examiner needs to acquire a 4TB drive but only has 2TB of available storage. Which approach is MOST appropriate?
- Perform a logical acquisition of only allocated files
- Use compressed forensic imaging (e.g., E01 with compression) (Correct answer)
- Skip acquisition and examine the original drive in-place
- Partition the image across multiple 1TB raw files using dd split
Correct answer: Use compressed forensic imaging (e.g., E01 with compression)
Compressed forensic image formats like E01 can significantly reduce storage requirements while maintaining forensic integrity and embedded hash verification.
Question 7: What is the purpose of performing a 'disk-to-disk' clone versus a 'disk-to-image' acquisition?
- Disk-to-disk clones are always preferred because they produce exact forensic images
- Disk-to-disk creates a bootable working copy while disk-to-image creates an investigative archive (Correct answer)
- Disk-to-disk is faster but does not preserve deleted files
- Disk-to-image copies only partition tables, not data
Correct answer: Disk-to-disk creates a bootable working copy while disk-to-image creates an investigative archive
Disk-to-disk cloning produces a bootable duplicate that can replace the original for examination, while disk-to-image creates a compressed archive used for analysis and preservation.
CHFI Data Acquisition and Duplication 2
Which acquisition method captures only the allocated, in-use clusters on a drive rather than every sector?