Module 04 - Types of Data Acquisition

What allows an investigator to capture only selected files or file types of interest to the case?

Logical acquisition

What collects fragments of unallocated data, allowing investigators to acquire deleted files?

Sparse acquisition

Which of the following are files that would fall in line with logical acquisition?

Collection of Outlook .pst or .ost files in email investigations

Which of the following are files that would fall in line with logical acquisition?

Specific record collection from a large RAID server

Which of the following is useful when it is not necessary to inspect the entire drive?

Sparse acquisition

What is is a bit-by-bit copy of any storage media that contains a cloned copy of the entire media, including all its sectors and clusters?

Bit-Stream Imaging

What cloned copy of the storage media contains all the latent data that enables investigators to retrieve deleted files and folders? Investigators often use bit-stream images of the suspect media to prevent contamination of the original media.

Bit-Stream Imaging

Investigators often use ________ of the suspect media to prevent contamination of the original media.

bit-stream images

Which of the following tool can read bit-stream images, which further facilitates the investigation process?

FTK Imager

Which of the following tool can read bit-stream images, which further facilitates the investigation process?

EnCase

What are two kinds of bit-stream imaging procedures?

Bitstream disk-to-image-file and bit-stream disk-to-disk

Which of the following data acquisition method is commonly used by investigators and is a flexible method that enables the creation of one or more copies of the suspect drive?

Bit-stream disk-to-image-file

Which of the following tool can be used to create image files?

ProDiscover

Which of the following tool can be used to create image files?

EnCase

Which of the following tool can be used to create image files?

FTK

Which of the following tool can be used to create image files?

The Sleuth Kit

Which of the following tool can be used to create image files?

X-Ways Forensics

Which of the following involves investigators not being able to create a bit-stream disk-to-image file in the following situations?

The suspect drive is very old and incompatible with the imaging software

Which of the following involves investigators not being able to create a bit-stream disk-to-image file in the following situations?

There is a need to recover credentials used for websites and user accounts

Which of the following bit-stream disk-to-disk copy of the original disk or drive can be performed?

While creating a disk-to-disk copy, the geometry of the target disk, including its head, cylinder, and track configuration, can be modified to align with the suspect drive.

What tool can help create a disk-to-disk bit-stream copy of the suspect drive?

EnCase

What tool can help create a disk-to-disk bit-stream copy of the suspect drive?

SafeBack

What tool can help create a disk-to-disk bit-stream copy of the suspect drive?

Tableau Forensic Imager