Data Acquisition and Recovery C8

Question 1

Two Types of Data Acquisition

Answer 1

1. Static Acquisition
2. Live Acquisition

Question 2

Bit-stream copy and Bit-stream image

Answer 2

Bit-stream copy = mirror image backup
Bit-stream image = Sector-by-sector copy of a physical or logical drive

Question 3

Three Formats

Answer 3

1. Raw Format
2. Proprietary format
3. Advanced forensics

Question 4

Raw Format pros and cons

Answer 4

Pros:
- fast data transfers
- can ignore minor data errors
Cons:
- require as much storage as original disk
- tools might not collect marginal sectors

Question 5

Proprietary Formats pros and cons

Answer 5

Pros:
- option to compress or not image files
- can split an image into smaller segments
Cons:
- Inability to share an image between different tools
- file size limitation

Question 6

Advanced Forensics Format

Answer 6

• simple design with extensibility
• open source for multiple platforms

Question 7

4 methods of data acquisitions

Answer 7

1. bit-stream disk-to-image file
2. bit-stream disk-to-disk
3. logical
4. sparse