Evidence Acquisition & Preservation Flashcards
7 cards from real ACE practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Evidence Acquisition & Preservation flashcards as text
An examiner receives a hard drive with a damaged partition table. Which FTK Imager feature allows imaging despite this condition?
Answer: Create Disk Image with custom sector range
Specifying a custom sector range lets the examiner image readable sectors even when the partition table is corrupt or missing.
Why should forensic images always be stored on media separate from the examiner's working copy?
Answer: To preserve the original evidence image unaltered while analysis is done on the copy
Keeping the original image untouched ensures that evidence integrity is maintained and the original can be re-examined if the working copy is corrupted.
During a network forensics investigation, which device should be imaged FIRST to capture the most transient data?
Answer: Network switches and their ARP/MAC tables
Switch ARP and MAC address tables are stored in volatile memory and clear rapidly, making them the most time-sensitive evidence to capture.
What is write-blocking and why is it critical during forensic acquisition?
Answer: It prevents any write commands from reaching the evidence drive, preserving its original state
Write-blockers intercept and discard write commands at the hardware or software level, ensuring no data on the evidence drive is modified during imaging.
Which AccessData tool is specifically designed for enterprise-scale evidence collection across networked endpoints without physical access?
Answer: FTK Enterprise / AD Enterprise
AD Enterprise (FTK Enterprise) performs remote live acquisition and triage across networked endpoints without requiring physical removal of drives.
A forensic image hash taken immediately after acquisition differs from the hash taken one week later. What does this indicate?
Answer: The image file has been modified or corrupted since acquisition
A changed hash value proves the image data is no longer identical to its state at acquisition, indicating tampering or corruption.
When imaging an SSD with TRIM enabled, which limitation must an examiner understand?
Answer: TRIM may have zeroed deleted sectors, making carving of deleted files less effective
TRIM actively zeroes sectors marked as deleted, potentially destroying data that would be recoverable from a traditional HDD's unallocated space.