CHFI Data Acquisition and Duplication 5 — Questions and Answers
Question 1: What is the primary purpose of using 'segment files' (e.g., E01.E01, E01.E02...) during forensic acquisition?
- To allow parallel hashing of each segment separately
- To accommodate file system size limits and enable splitting across multiple storage media (Correct answer)
- To encrypt each segment with a different key for security
- To allow different examiners to work on separate segments simultaneously
Correct answer: To accommodate file system size limits and enable splitting across multiple storage media
Forensic image segmentation splits large images into manageable chunks to work within file system limitations (e.g., FAT32's 4GB limit) or to span multiple storage devices.
Question 2: Which of the following scenarios REQUIRES a live acquisition rather than a static (dead-box) acquisition?
- A powered-off laptop found at a crime scene
- A running database server with encrypted volumes that will lock on shutdown (Correct answer)
- A drive connected to a decommissioned workstation
- A USB drive found in a suspect's bag
Correct answer: A running database server with encrypted volumes that will lock on shutdown
Encrypted volumes are only accessible while the system is running and the keys are loaded in memory; shutting down would lock the encrypted data.
Question 3: In FTK Imager, what does the 'Verify images after they are created' option do?
- Re-images the drive a second time to compare both images
- Reads the completed image and recalculates the hash to confirm it matches the acquisition hash (Correct answer)
- Checks the image for file system errors using chkdsk
- Submits the image hash to an online verification database
Correct answer: Reads the completed image and recalculates the hash to confirm it matches the acquisition hash
FTK Imager's post-acquisition verification reads the completed image file and recalculates its hash, confirming it matches the hash computed during acquisition.
Question 4: What is 'remote forensic acquisition' and what network tool is commonly used to facilitate it?
- Imaging a drive over the internet using cloud storage APIs
- Acquiring evidence from a remote computer using an agent (e.g., EnCase Enterprise) deployed on the target (Correct answer)
- Using RDP to manually copy files from a remote system
- Performing acquisition via VPN with a hardware write blocker at the remote site
Correct answer: Acquiring evidence from a remote computer using an agent (e.g., EnCase Enterprise) deployed on the target
Remote forensic acquisition uses an agent (such as EnCase Enterprise's SAFE server or F-Response) deployed on the target machine to allow an examiner to image it across the network.
Question 5: Which acquisition order principle, based on volatility, should guide what is collected FIRST during live forensic response?
- Hard drive contents, then RAM, then network connections
- CPU registers and cache, then RAM, then swap space, then disk (Correct answer)
- Disk first because it is the most stable evidence
- Log files first because they will be overwritten by new events
Correct answer: CPU registers and cache, then RAM, then swap space, then disk
The order of volatility (RFC 3227) dictates collecting the most transient data first: CPU/cache → RAM → swap → network state → running processes → disk → archival media.
Question 6: When acquiring a mobile device using Cellebrite UFED, what does a 'physical extraction' provide compared to a 'logical extraction'?
- Physical extraction is faster but captures fewer artifacts than logical
- Physical extraction dumps the raw flash memory, recovering deleted data and system areas invisible to logical tools (Correct answer)
- Physical extraction only works on Android devices, not iOS
- Physical extraction requires the device to be powered off
Correct answer: Physical extraction dumps the raw flash memory, recovering deleted data and system areas invisible to logical tools
Physical extraction accesses the raw NAND flash memory, enabling recovery of deleted files and data in unallocated space that a logical extraction (which uses the device's own APIs) cannot access.
Question 7: What is 'chain of custody' documentation required to include for a forensic image to be admissible in court?
- Only the hash value of the image is legally required
- Identity of each person who handled the evidence, dates/times of transfer, and condition of evidence at each transfer (Correct answer)
- A signed affidavit from the forensic tool vendor confirming software accuracy
- The suspect's signature acknowledging the acquisition occurred
Correct answer: Identity of each person who handled the evidence, dates/times of transfer, and condition of evidence at each transfer
Chain of custody records must document every person who handled the evidence, when transfers occurred, and the evidence's condition, establishing an unbroken accountability trail from collection to court.
CHFI Data Acquisition and Duplication 5
What is the primary purpose of using 'segment files' (e.g., E01.E01, E01.E02...) during forensic acquisition?