Exam 4: Data Acquisition

Unlike RAID 0, RAID 3 stripes tracks across all disks that make up one volume.

Match each item with a statement below: -ILook imaging tool

Linux ISO images are referred to as ____.

Typically, a(n) ____ acquisition is done on a computer seized during a police raid, for example.

The ____ command creates a raw format file that most computer forensics analysis tools can read, which makes it useful for data acquisitions.

Explain the sparse data copy method for acquiring digital evidence.

There are two types of acquisitions: static acquisitions and ____________________ acquisitions.

Match each item with a statement below: -process of copying data

Match each item with a statement below: -example of a lossless compression tool

EnCase Enterprise is set up with an Examiner workstation and a Secure Authentication for EnCase (____) workstation

For computer forensics, ____ is the task of collecting digital evidence from electronic media.

SafeBack performs a(n) ____ calculation for each sector copied to ensure data integrity

The ____ command displays pages from the online help manual for information on Linux commands and their options.

What are some of the main characteristics of Linux ISO images designed for computer forensics?

What are the advantages and disadvantages of using raw data acquisition format?

What are some of the design goals of AFF?

Image files can be reduced by as much as ____% of the original.

The ____ DOS program En.exe requires using a forensic MS-DOS boot floppy or CD and a network crossover cable.

Dr. Simson L. Garfinkel of Basis Technology Corporation recently developed a new open-source acquisition format called ____________________.

If the computer has an encrypted drive, a ____ acquisition is done if the password or passphrase is available.