CHFI Data Acquisition and Duplication 4

Question 1

What is the Device Configuration Overlay (DCO) and how does it differ from the HPA?

Accepted Answer

DCO is configured by the manufacturer or OEM to limit drive capacity; HPA is user-configurable

Answer

The DCO is typically set by manufacturers to standardize drive capacity across product lines, while the HPA can be set by the user or OS to hide data; both are invisible to the OS.

Question 2

A forensic examiner is acquiring a drive from a Mac with Apple Silicon (M1/M2). What is a key challenge compared to Intel-based Macs?

Accepted Answer

Target Disk Mode is not available; acquisition requires OS-level tools or JTAG methods

Answer

Apple Silicon Macs removed Target Disk Mode, making traditional hardware-based acquisition impossible and requiring alternative methods like using Apple Configurator or specialized JTAG hardware.

Question 3

Which dcfldd command option generates a hash of the acquired image simultaneously during the imaging process?

Accepted Answer

hashlog=

Answer

dcfldd's 'hashlog=' option writes a running hash (MD5 or SHA-1) to a specified log file as the image is being created, enabling simultaneous acquisition and verification.

Question 4

What is 'forensic soundness' in the context of data acquisition?

Accepted Answer

Ensuring the acquisition process does not alter original evidence and can be independently verified

Answer

Forensic soundness means the acquisition method preserves original evidence without modification and produces results that can be independently repeated and verified.

Question 5

When creating a forensic image of a RAID array, what is the RECOMMENDED approach?

Accepted Answer

Image each individual disk separately, then reassemble the RAID virtually in analysis software

Answer

Imaging each disk individually and then using forensic software to virtually reconstruct the RAID ensures the original disks are not modified and allows flexible analysis.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Data Acquisition and Duplication 4