Deck 4: Data Acquisition

Question 1

Many acquisition tools don't copy data in the host protected area (HPA) of a disk drive.

Answer 1

True

Question 2

FTK Imager requires that you use a device such as a USB or parallel port dongle for licensing.

Answer 2

True

Question 3

The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your evidence image file.

Answer 3

True

Question 4

Typically, a(n) ____ acquisition is done on a computer seized during a police raid, for example.

A) live
B) online
C) real-time
D) static

Question 5

For computer forensics, ____ is the task of collecting digital evidence from electronic media.

A) hashing
B) data acquisition
C) lossy compression
D) lossless compression

Question 6

One advantage with live acquisitions is that you are able to perform repeatable processes.

Question 7

One major disadvantage of ____ format acquisitions is the inability to share an image between different vendors' computer forensics analysis tools.

A) proprietary
B) raw
C) AFF
D) AFD

Question 8

SafeBack and SnapCopy must run from a(n) ____ system.

A) UNIX
B) MS-DOS
C) Linux
D) Solaris

Question 9

The most common and flexible data-acquisition method is ____.

A) Disk-to-disk copy
B) Disk-to-network copy
C) Disk-to-image file copy
D) Sparse data copy

Question 10

Linux ISO images are referred to as ____.

A) ISO CDs
B) Live CDs
C) Forensic Linux
D) Linux in a Box

Question 11

Current distributions of Linux include two hashing algorithm utilities: md5sum and ____.

A) rcsum
B) shasum
C) hashsum
D) sha1sum

Question 12

The ____ command creates a raw format file that most computer forensics analysis tools can read, which makes it useful for data acquisitions.

A) fdisk
B) dd
C) man
D) raw

Question 13

The ____ command displays pages from the online help manual for information on Linux commands and their options.

A) cmd
B) hlp
C) inst
D) man

Question 14

Microsoft has recently added ____ in its Vista Ultimate and Enterprise editions, which makes performing static acquisitions more difficult.

A) whole disk encryption
B) backup utilities
C) recovery wizards
D) NTFS

Question 15

Image files can be reduced by as much as ____% of the original.

A) 15
B) 25
C) 30
D) 50

Question 16

If your time is limited, consider using a logical acquisition or ____ acquisition data copy method.

A) lossless
B) disk-to-disk
C) sparse
D) disk-to-image

Question 17

If the computer has an encrypted drive, a ____ acquisition is done if the password or passphrase is available.

A) passive
B) static
C) live
D) local

Question 18

The ____ DOS program En.exe requires using a forensic MS-DOS boot floppy or CD and a network crossover cable.

A) ProDiscover
B) ILook
C) DIBS USA
D) EnCase

Question 19

The ____ command, works similarly to the dd command but has many features designed for computer forensics acquisitions.

A) raw
B) bitcopy
C) dcfldd
D) man

Question 20

Unlike RAID 0, RAID 3 stripes tracks across all disks that make up one volume.

Question 21

____ is the only automated disk-to-disk tool that allows you to copy data to a slightly smaller target drive than the original suspect's drive.

A) SafeBack
B) EnCase
C) SnapCopy
D) SMART

Question 22

Match each item with a statement below
a.SafeBack
f.fdisk -l
b.WinZip
g.Lossy compression
c.Data acquisition
h.Jaz disk
d.AFF
i.EnCase
e.IXimager
process of copying data

Question 23

Bit-stream data to files copy technique creates simple sequential flat files of a suspect drive or data set. The output of these flat files is referred to as a(n) ____________________ format.

Question 24

SnapBack DatArrest can perform a data copy of an evidence drive in ____ ways.

A) two
B) three
C) four
D) five

Question 25

Match each item with a statement below
a.SafeBack
f.fdisk -l
b.WinZip
g.Lossy compression
c.Data acquisition
h.Jaz disk
d.AFF
i.EnCase
e.IXimager
open source data acquisition format

Question 26

SnapBack DatArrest runs from a true ____ boot floppy.

A) UNIX
B) Linux
C) Mac OS X
D) MS-DOS

Question 27

Match each item with a statement below
a.SafeBack
f.fdisk -l
b.WinZip
g.Lossy compression
c.Data acquisition
h.Jaz disk
d.AFF
i.EnCase
e.IXimager
type of SCSI drive

Question 28

____________________ is the default format for acquisitions for Guidance Software EnCase.

Question 29

Match each item with a statement below
a.SafeBack
f.fdisk -l
b.WinZip
g.Lossy compression
c.Data acquisition
h.Jaz disk
d.AFF
i.EnCase
e.IXimager
example of a lossless compression tool

Question 30

Popular archiving tools, such as PKZip and WinZip, use an algorithm referred to as ____________________ compression.

Question 31

Dr. Simson L. Garfinkel of Basis Technology Corporation recently developed a new open-source acquisition format called ____________________.

Question 32

Match each item with a statement below
a.SafeBack
f.fdisk -l
b.WinZip
g.Lossy compression
c.Data acquisition
h.Jaz disk
d.AFF
i.EnCase
e.IXimager
example of a disk-to-disk copy maker tool

Question 33

There are two types of acquisitions: static acquisitions and ____________________ acquisitions.

Question 34

SafeBack performs a(n) ____ calculation for each sector copied to ensure data integrity

A) SHA-1
B) MC5
C) SHA-256
D) MC4

Question 35

Match each item with a statement below
a.SafeBack
f.fdisk -l
b.WinZip
g.Lossy compression
c.Data acquisition
h.Jaz disk
d.AFF
i.EnCase
e.IXimager
shows the known drives connected to your computer

Question 36

Match each item with a statement below
a.SafeBack
f.fdisk -l
b.WinZip
g.Lossy compression
c.Data acquisition
h.Jaz disk
d.AFF
i.EnCase
e.IXimager
forensic tool developed by Guidance Software

Question 37

____ has developed the Rapid Action Imaging Device (RAID) to make forensically sound disk copies.

A) DIBS USA
B) EnCase
C) ProDiscover
D) ILook

Question 38

Match each item with a statement below
a.SafeBack
f.fdisk -l
b.WinZip
g.Lossy compression
c.Data acquisition
h.Jaz disk
d.AFF
i.EnCase
e.IXimager
used with .jpeg files to reduce file size and doesn't affect image quality when the file is restored and viewed

Question 39

Match each item with a statement below
a.SafeBack
f.fdisk -l
b.WinZip
g.Lossy compression
c.Data acquisition
h.Jaz disk
d.AFF
i.EnCase
e.IXimager
ILook imaging tool

Question 40

EnCase Enterprise is set up with an Examiner workstation and a Secure Authentication for EnCase (____) workstation

A) ILook
B) SAFE
C) Incident Response
D) Investigator

Question 41

What are the considerations you should have when deciding what data-acquisition method to use on your investigation?

Question 42

What are the advantages and disadvantages of using raw data acquisition format?

Question 43

What are the requirements for acquiring data on a suspect computer using Linux?

Question 44

What are some of the main characteristics of Linux ISO images designed for computer forensics?

Question 45

What are some of the features offered by proprietary data acquisition formats?

Question 46

Explain the sparse data copy method for acquiring digital evidence.

Question 47

Explain the use of hash algorithms to verify the integrity of lossless compressed data.

Question 48

What are the steps to update the Registry for Windows XP SP2 to enable write-protection with USB devices?

Question 49

What are some of the design goals of AFF?

Question 50

What are the advantages and disadvantages of using Windows acquisition tools?