CHFI Data Acquisition and Duplication 5

Question 1

What is the primary purpose of using 'segment files' (e.g., E01.E01, E01.E02...) during forensic acquisition?

Accepted Answer

To accommodate file system size limits and enable splitting across multiple storage media

Answer

Forensic image segmentation splits large images into manageable chunks to work within file system limitations (e.g., FAT32's 4GB limit) or to span multiple storage devices.

Question 2

Which of the following scenarios REQUIRES a live acquisition rather than a static (dead-box) acquisition?

Accepted Answer

A running database server with encrypted volumes that will lock on shutdown

Answer

Encrypted volumes are only accessible while the system is running and the keys are loaded in memory; shutting down would lock the encrypted data.

Question 3

In FTK Imager, what does the 'Verify images after they are created' option do?

Accepted Answer

Reads the completed image and recalculates the hash to confirm it matches the acquisition hash

Answer

FTK Imager's post-acquisition verification reads the completed image file and recalculates its hash, confirming it matches the hash computed during acquisition.

Question 4

What is 'remote forensic acquisition' and what network tool is commonly used to facilitate it?

Accepted Answer

Acquiring evidence from a remote computer using an agent (e.g., EnCase Enterprise) deployed on the target

Answer

Remote forensic acquisition uses an agent (such as EnCase Enterprise's SAFE server or F-Response) deployed on the target machine to allow an examiner to image it across the network.

Question 5

Which acquisition order principle, based on volatility, should guide what is collected FIRST during live forensic response?

Accepted Answer

CPU registers and cache, then RAM, then swap space, then disk

Answer

The order of volatility (RFC 3227) dictates collecting the most transient data first: CPU/cache → RAM → swap → network state → running processes → disk → archival media.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Data Acquisition and Duplication 5