Data Acquisition Flashcards
If your time is limited, what type of acquisition data copy method should you consider?
Sparse
What command works similarly to the dd command but has many features designed for computer forensics acquisitions?
dcfldd
What type of acquisition is done if the computer has an encrypted drive and the password or passphrase is available?
Live
What did Microsoft add to its newer operating systems that make performing static acquisitions more difficult?
Whole disk encryption
Which RAID configuration offers the greatest access speed and the most robust data recovery capability?
RAID 15
What option is used with the dcfldd command to designate a hashing algorithm of md5, sha1, sha256, sha384, or sha512?
hash
If the computer has an encrypted drive, a live acquisition is done if the password or passphrase is not available?
False
In addition to RAID 0, what type of RAID configuration is available for Windows XP, 2000, and NT servers and workstations?
RAID 1
What type of acquisition is used for most remote acquisitions?
Live
What term refers to the Linux ISO images that can be burned to a CD or DVD?
Linux Live CDs
By what percentage can lossless compression reduce image file size?
50 percent
A separate manual validation is recommended for all raw acquisitions at the time of analysis.
True
What does Autopsy use to validate an image?
MD5
In Autopsy and many other forensics tools, raw format image files don’t contain metadata.
True
There’s no simple method for getting an image of a RAID server’s disks
True
The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your disk-to-image file.
True
FTK Imager requires that you use a device such as a USB dongle for licensing.
True
Unlike RAID 0, RAID 3 stripes track across all disks that make up one volume.
False
What older Microsoft disk compression tool eliminates only slack disk space between files?
DriveSpace
What command displays pages from the online help manual for information on Linux commands and their options?
man
Similar to Linux, Windows also has built-in hashing algorithm tools for digital forensics.
False
Some acquisition tools don’t copy data in the host protected area (HPA) of a disk drive.
True
Which type of format acquisition leaves the investigator unable to share an image between different vendors’ computer forensics analysis tools?
Proprietary
In addition to md5sum, which hashing algorithm utility is included with current distributions of Linux?
sha1sum
Acquisitions of RAID drives can be challenging and frustrating for digital forensics examiners because of how RAID systems are designed, configured, and sized.
True
What’s the most critical aspect of digital evidence?
Validation
Name the three formats for digital forensics data acquisitions
Raw, Proprietary formats, and AFF
Name the three formats for digital forensics data acquisitions
Raw, Proprietary formats, and AFF
With remote acquisitions, what problems should you be aware of?
Antivirus, antispyware, and firewall programs
Why is it a good practice to make two images of a suspect drive in a critical investigation?
To ensure at least one good copy of the forensically collected data in case of any failures
What’s the maximum file size when writing data to a FAT32 drive?
2 GB
In Linux, the fdisk -l command lists the suspect drive as /dev/hda1. So, is the following dcfldd command correct? ddfldd if+image_file.img of=/dev/hda1
False
Of all the proprietary formats, which one is the unofficial standard?
Expert Witness
What are two concerns when acquiring data from a RAID server?
Amount of data storage needed and type of RAID
With newer Linux kernel distributions, USB devices are automatically mounted, which can alter data on it.
True
Which forensics tools can connect to a suspect’s remote computer and run surreptitiously?
EnCase Enterprise and ProDiscover Incident Response
A hashing algorithm is a program designed to create a binary or hexadecimal number that represents the uniqueness of a data set, file, or entire disk
True
A logical acquisition collects only specific files of interest to the case
True
What does a sparse acquisition collect for an investigation?
Fragments of unallocated data in addition to the logical allocated data
Name two commercial tools that can make a forensic sector-by-sector copy of a drive to a larger drive
EnCase and X-ways Forensics
FTK Imager can acquire data in a drive’s host protected area
False
Commonly, proprietary format acquisition files can compress the acquisition data and segment acquisition output files into smaller volumes
True
The main goal of a static acquisition is the preservation of digital evidence.
True
Slower data transfer speeds and dealing with minor data errors are two disadvantages of the raw format
False
In the Linux dcfldd command, which three options are used for validating data?
hash, hashlog, and vf
