Data Acquisition and Recovery C8 Flashcards

1
Q

Two Types of Data Acquisition

A
  1. Static Acquisition
  2. Live Acquisition
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Bit-stream copy and Bit-stream image

A

Bit-stream copy = mirror image backup
Bit-stream image = Sector-by-sector copy of a physical or logical drive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Three Formats

A
  1. Raw Format
  2. Proprietary format
  3. Advanced forensics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Raw Format pros and cons

A

Pros:
- fast data transfers
- can ignore minor data errors
Cons:
- require as much storage as original disk
- tools might not collect marginal sectors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Proprietary Formats pros and cons

A

Pros:
- option to compress or not image files
- can split an image into smaller segments
Cons:
- Inability to share an image between different tools
- file size limitation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Advanced Forensics Format

A
  • simple design with extensibility
  • open source for multiple platforms
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

4 methods of data acquisitions

A
  1. bit-stream disk-to-image file
  2. bit-stream disk-to-disk
  3. logical
  4. sparse
How well did you know this?
1
Not at all
2
3
4
5
Perfectly