Data Acquisition and Duplication Flashcards
7 cards from real CHFI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Data Acquisition and Duplication flashcards as text
Which acquisition method captures only the allocated, in-use clusters on a drive rather than every sector?
Answer: Logical acquisition
Logical acquisition copies only the active file system contents (allocated clusters), not unallocated space or slack space.
A suspect's laptop uses full-disk BitLocker encryption and is found powered ON. What is the BEST immediate action to preserve decrypted data?
Answer: Perform a live RAM acquisition before powering off
Performing a live RAM acquisition captures the BitLocker encryption keys stored in volatile memory before the machine is powered off.
In the dd command 'dd if=/dev/sda of=/mnt/evidence/disk.img bs=512 conv=noerror,sync', what does the 'sync' option do?
Answer: Pads bad blocks with zeros to maintain image size integrity
The 'sync' option pads every failed read block with null bytes so the output image remains the same size as the source, preserving offset alignment.
Which of the following is a PRIMARY advantage of using EnCase's E01 format over a raw dd image?
Answer: E01 embeds case metadata and a hash for integrity verification within the file
The E01 (Expert Witness) format stores case metadata, examiner notes, and MD5/SHA-1 hashes inside the image container itself for built-in integrity verification.
What distinguishes a 'selective' acquisition from a 'full physical' acquisition?
Answer: Selective acquisition targets specific files or folders based on relevance criteria
Selective acquisition collects only specific, forensically relevant files or directories rather than imaging the entire drive.
A forensic examiner needs to acquire a 4TB drive but only has 2TB of available storage. Which approach is MOST appropriate?
Answer: Use compressed forensic imaging (e.g., E01 with compression)
Compressed forensic image formats like E01 can significantly reduce storage requirements while maintaining forensic integrity and embedded hash verification.
What is the purpose of performing a 'disk-to-disk' clone versus a 'disk-to-image' acquisition?
Answer: Disk-to-disk creates a bootable working copy while disk-to-image creates an investigative archive
Disk-to-disk cloning produces a bootable duplicate that can replace the original for examination, while disk-to-image creates a compressed archive used for analysis and preservation.