CHFI Data Acquisition and Duplication 2

Question 1

Which acquisition method captures only the allocated, in-use clusters on a drive rather than every sector?

Accepted Answer

Logical acquisition

Answer

Logical acquisition copies only the active file system contents (allocated clusters), not unallocated space or slack space.

Question 2

A suspect's laptop uses full-disk BitLocker encryption and is found powered ON. What is the BEST immediate action to preserve decrypted data?

Accepted Answer

Perform a live RAM acquisition before powering off

Answer

Performing a live RAM acquisition captures the BitLocker encryption keys stored in volatile memory before the machine is powered off.

Question 3

In the dd command 'dd if=/dev/sda of=/mnt/evidence/disk.img bs=512 conv=noerror,sync', what does the 'sync' option do?

Accepted Answer

Pads bad blocks with zeros to maintain image size integrity

Answer

The 'sync' option pads every failed read block with null bytes so the output image remains the same size as the source, preserving offset alignment.

Question 4

Which of the following is a PRIMARY advantage of using EnCase's E01 format over a raw dd image?

Accepted Answer

E01 embeds case metadata and a hash for integrity verification within the file

Answer

The E01 (Expert Witness) format stores case metadata, examiner notes, and MD5/SHA-1 hashes inside the image container itself for built-in integrity verification.

Question 5

What distinguishes a 'selective' acquisition from a 'full physical' acquisition?

Accepted Answer

Selective acquisition targets specific files or folders based on relevance criteria

Answer

Selective acquisition collects only specific, forensically relevant files or directories rather than imaging the entire drive.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Data Acquisition and Duplication 2