Chapter 3- Data Aquisition

Question 1

Advanced Forensic Format (AFF)

Answer 1

A file format designed for the storage and exchange of forensic evidence. It is a flexible format that allows for the inclusion of metadata and can handle multiple images and data types. An example of its use would be a digital forensic investigator using AFF to create a forensic image of a hard drive during an investigation.

Question 2

Host protected area (HPA)

Answer 2

A hidden area on a hard drive that can be used to store data or software. It can be used by manufacturers to store firmware or diagnostic tools, but it can also be used by attackers to hide malicious code. An example of its use would be a manufacturer using HPA to store diagnostic tools on a hard drive to make it easier to service.

Question 3

Live acquisitions

Answer 3

The process of collecting evidence from a running system or device, while it is still operational. This can include collecting data from memory, network connections, and running processes. An example of its use would be a digital forensic investigator collecting data from a computer that is still turned on and in use during an investigation.

Question 4

Logical acquisition

Answer 4

The process of collecting data from a device or system based on its logical structure, such as files and directories. This can include data recovery from deleted files or partitions. An example of its use would be a digital forensic investigator recovering data from a deleted file on a hard drive during an investigation.

Question 5

Raw format

Answer 5

A file format that contains the entire contents of a disk or other storage device, including any unused space. It can be used for forensic imaging, but is not suitable for data recovery or analysis. An example of its use would be a digital forensic investigator creating a raw image of a hard drive during an investigation.

Question 6

Redundant array of independent disks (RAID)

Answer 6

A storage system that uses multiple disks to improve performance and reliability. RAID can be challenging to image and analyze, as data can be distributed across multiple disks. An example of its use would be a company using RAID to store important data and files on their server to improve performance and reliability.

Question 7

Sparse acquisition

Answer 7

A type of forensic imaging that only captures the used portions of a disk or other storage device, rather than imaging the entire device. This can be useful for reducing the time and storage space required for forensic imaging. An example of its use would be a digital forensic investigator capturing only the used portions of a hard drive during an investigation to reduce the amount of data that needs to be analyzed.

Question 8

Static acquisitions

Answer 8

The process of collecting evidence from a device or system that is turned off or disconnected. This can include removing hard drives or other storage devices for forensic analysis. An example of its use would be a digital forensic investigator removing a hard drive from a computer for analysis during an investigation.

Question 9

Whole disk encryption

Answer 9

A security measure that encrypts the entire contents of a disk or other storage device, rather than individual files or directories. It can make data recovery and forensic analysis more challenging, as the data is inaccessible without the encryption key. An example of its use would be a company encrypting their hard drives to protect sensitive data from unauthorized access.

Question 10

The main goal of a static acquisition is to

Answer 10

collect evidence from a device or system that is turned off or disconnected.

Question 11

The three formats for digital forensics data acquisitions are

Answer 11

raw format, proprietary format, and logical format.

Question 12

Two advantages of the raw format are that it

Answer 12

captures the entire contents of a disk and can be used for forensic imaging. Two disadvantages are that it can be large in size and is not suitable for data recovery or analysis.

Question 13

Two features common with proprietary format acquisition files are that they

Answer 13

may include encryption and may require specialized software for analysis.

Question 14

The unofficial standard for proprietary formats is

Answer 14

EnCase

Question 15

Two commercial tools that can make a forensic sector-by-sector copy of a drive to a larger drive are

Answer 15

FTK Imager and EnCase.

Question 16

A logical acquisition collects data based

Answer 16

on the logical structure of the device or system, such as files and directories.

Question 17

A sparse acquisition collects only the

Answer 17

used portions of a disk or storage device, rather than imaging the entire device.

Question 18

When determining which data acquisition method to use, you should consider factors such as

Answer 18

the type of device or system, the size of the storage media, and the type of data being collected.

Question 19

It is a good practice to make two images of a suspect drive in

Answer 19

a critical investigation in case one image becomes corrupted or compromised.

Question 20

When performing an acquisition at a remote location,

Answer 20

you should consider factors such as network bandwidth, access permissions, and security measures such as encryption.

Question 21

With newer Linux kernel distributions, a hot-swappable device containing evidence may

Answer 21

automatically mount, potentially altering or compromising the evidence.

Question 22

The dcfldd command may not be correct as it assumes the suspect drive is located at

Answer 22

/dev/hda1, which may not always be the case.

Question 23

The most critical aspect of digital evidence is maintaining its

Answer 23

integrity to ensure it is admissible in court.

Question 24

A hashing algorithm is a mathematical function that generates

Answer 24

a unique digital signature or hash value for a given set of data.

Question 25

The three options used for validating data in the dcfldd command

Answer 25

are hash, md5, and sha1.

Question 26

The maximum file size when writing data to a FAT32 drive

Answer 26

is 4 GB.

Question 27

Two concerns when acquiring data from a RAID server are that

Answer 27

the data may be distributed across multiple disks and that RAID configurations can be complex and may require specialized tools for analysis.

Question 28

Problems to be aware of with remote acquisitions

Answer 28

include data transfer speeds, access permissions over the network, and security measures such as antivirus and firewall programs.

Question 29

Forensic tools that can connect to a

Answer 29

suspect’s remote computer and run surreptitiously include RATs (Remote Access Trojans) and backdoors.

Question 30

EnCase, FTK, SMART, and ILookIX treat an image file as a separate file, not as the original disk.

Answer 30

False.

Question 31

FTK Imager can acquire data from a drive’s host protected area.

Answer 31

True.