Question 1

____________________ is the default format for acquisitions for Guidance Software EnCase.

Accepted Answer

The answer of ____________________ is the default format for acquisitions...

Question 2

The most common and flexible data-acquisition method is ____.

Accepted Answer

A)  Disk-to-disk copy 
B)  Disk-to-network copy 
C)  Disk-to-image file copy 
D)  Sparse data copy 
A)  Disk-to-disk copy 
B)  Disk-to-network copy 
C)  Disk-to-image file copy 
D)  Sparse data copy

Question 3

Explain the use of hash algorithms to verify the integrity of lossless compressed data.

Accepted Answer

An easy way to test lossless compression

Question 4

Microsoft has recently added ____ in its Vista Ultimate and Enterprise editions, which makes performing static acquisitions more difficult.

Accepted Answer

A)  whole disk encryption 
B)  backup utilities 
C)  recovery wizards 
D)  NTFS 
A)  whole disk encryption 
B)  backup utilities 
C)  recovery wizards 
D)  NTFS

Question 5

What are some of the features offered by proprietary data acquisition formats?

Accepted Answer

Most commercial computer forensics tools

Question 6

What are the requirements for acquiring data on a suspect computer using Linux?

Accepted Answer

A unique feature of a forensics Linux Li

Question 7

Many acquisition tools don't copy data in the host protected area (HPA) of a disk drive.

Accepted Answer

A) True 
 B)False

Question 8

Match each item with a statement below:
-used with .jpeg files to reduce file size and doesn't affect image quality when the file is restored and viewed

Accepted Answer

A) SafeBack 
B) WinZip 
C) Data acquisition 
D) AFF 
E) IXimager
F)fdisk -l
G)Lossy compression
H)Jaz disk
I)EnCase 
A) SafeBack 
B) WinZip 
C) Data acquisition 
D) AFF 
E) IXimager
F)fdisk -l
G)Lossy compression
H)Jaz disk
I)EnCase

Question 9

If your time is limited, consider using a logical acquisition or ____ acquisition data copy method.

Accepted Answer

A)  lossless 
B)  disk-to-disk 
C)  sparse 
D)  disk-to-image 
A)  lossless 
B)  disk-to-disk 
C)  sparse 
D)  disk-to-image

Question 10

Match each item with a statement below:
-shows the known drives connected to your computer

Accepted Answer

A) SafeBack 
B) WinZip 
C) Data acquisition 
D) AFF 
E) IXimager
F)fdisk -l
G)Lossy compression
H)Jaz disk
I)EnCase 
A) SafeBack 
B) WinZip 
C) Data acquisition 
D) AFF 
E) IXimager
F)fdisk -l
G)Lossy compression
H)Jaz disk
I)EnCase

Question 11

Match each item with a statement below:
-open source data acquisition format

Accepted Answer

A) SafeBack 
B) WinZip 
C) Data acquisition 
D) AFF 
E) IXimager
F)fdisk -l
G)Lossy compression
H)Jaz disk
I)EnCase 
A) SafeBack 
B) WinZip 
C) Data acquisition 
D) AFF 
E) IXimager
F)fdisk -l
G)Lossy compression
H)Jaz disk
I)EnCase

Question 12

____ has developed the Rapid Action Imaging Device (RAID) to make forensically sound disk copies.

Accepted Answer

A)  DIBS USA 
B)  EnCase 
C)  ProDiscover 
D)  ILook 
A)  DIBS USA 
B)  EnCase 
C)  ProDiscover 
D)  ILook

Question 13

What are the advantages and disadvantages of using Windows acquisition tools?

Accepted Answer

Many computer forensics software vendors

Question 14

Match each item with a statement below:
-forensic tool developed by Guidance Software

Accepted Answer

A) SafeBack 
B) WinZip 
C) Data acquisition 
D) AFF 
E) IXimager
F)fdisk -l
G)Lossy compression
H)Jaz disk
I)EnCase 
A) SafeBack 
B) WinZip 
C) Data acquisition 
D) AFF 
E) IXimager
F)fdisk -l
G)Lossy compression
H)Jaz disk
I)EnCase

Question 15

The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your evidence image file.

Accepted Answer

A) True 
 B)False

Question 16

Bit-stream data to files copy technique creates simple sequential flat files of a suspect drive or data set. The output of these flat files is referred to as a(n) ____________________ format.

Accepted Answer

The answer of Bit-stream data to files copy technique creates...

Question 17

Popular archiving tools, such as PKZip and WinZip, use an algorithm referred to as ____________________ compression.

Accepted Answer

The answer of Popular archiving tools, such as PKZip and...

Question 18

What are the steps to update the Registry for Windows XP SP2 to enable write-protection with USB devices?

Accepted Answer

To update the Registry for Windows XP SP

Question 19

FTK Imager requires that you use a device such as a USB or parallel port dongle for licensing.

Accepted Answer

A) True 
 B)False

Question 20

SafeBack and SnapCopy must run from a(n) ____ system.

Accepted Answer

A)  UNIX 
B)  MS-DOS 
C)  Linux 
D)  Solaris 
A)  UNIX 
B)  MS-DOS 
C)  Linux 
D)  Solaris

____________________ is the default format for acquisitions for Guidance Software EnCase.

The most common and flexible data-acquisition method is ____.

Explain the use of hash algorithms to verify the integrity of lossless compressed data.

Microsoft has recently added ____ in its Vista Ultimate and Enterprise editions, which makes performing static acquisitions more difficult.

What are some of the features offered by proprietary data acquisition formats?

What are the requirements for acquiring data on a suspect computer using Linux?

Many acquisition tools don't copy data in the host protected area (HPA) of a disk drive.

Match each item with a statement below: -used with .jpeg files to reduce file size and doesn't affect image quality when the file is restored and viewed

If your time is limited, consider using a logical acquisition or ____ acquisition data copy method.

Match each item with a statement below: -shows the known drives connected to your computer

Match each item with a statement below: -open source data acquisition format

____ has developed the Rapid Action Imaging Device (RAID) to make forensically sound disk copies.

What are the advantages and disadvantages of using Windows acquisition tools?

Match each item with a statement below: -forensic tool developed by Guidance Software

The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your evidence image file.

Bit-stream data to files copy technique creates simple sequential flat files of a suspect drive or data set. The output of these flat files is referred to as a(n) ____________________ format.

Popular archiving tools, such as PKZip and WinZip, use an algorithm referred to as ____________________ compression.

What are the steps to update the Registry for Windows XP SP2 to enable write-protection with USB devices?

FTK Imager requires that you use a device such as a USB or parallel port dongle for licensing.

SafeBack and SnapCopy must run from a(n) ____ system.

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters

Exam 4: Data Acquisition

____________________ is the default format for acquisitions for Guidance Software EnCase.

The most common and flexible data-acquisition method is ____.

Explain the use of hash algorithms to verify the integrity of lossless compressed data.

Microsoft has recently added ____ in its Vista Ultimate and Enterprise editions, which makes performing static acquisitions more difficult.

What are some of the features offered by proprietary data acquisition formats?

What are the requirements for acquiring data on a suspect computer using Linux?

Many acquisition tools don't copy data in the host protected area (HPA) of a disk drive.

Match each item with a statement below: -used with .jpeg files to reduce file size and doesn't affect image quality when the file is restored and viewed

If your time is limited, consider using a logical acquisition or ____ acquisition data copy method.

Match each item with a statement below: -shows the known drives connected to your computer

Match each item with a statement below: -open source data acquisition format

____ has developed the Rapid Action Imaging Device (RAID) to make forensically sound disk copies.

What are the advantages and disadvantages of using Windows acquisition tools?

Match each item with a statement below: -forensic tool developed by Guidance Software

The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your evidence image file.

Bit-stream data to files copy technique creates simple sequential flat files of a suspect drive or data set. The output of these flat files is referred to as a(n) ____________________ format.

Popular archiving tools, such as PKZip and WinZip, use an algorithm referred to as ____________________ compression.

What are the steps to update the Registry for Windows XP SP2 to enable write-protection with USB devices?

FTK Imager requires that you use a device such as a USB or parallel port dongle for licensing.

SafeBack and SnapCopy must run from a(n) ____ system.

Computer Forensics and Investigations As a Profession

Understanding Computer Investigations

The Investigators Office and Laboratory

Processing Crime and Incident Scenes

Working With Windows and Dos Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Computer Forensics Analysis and Validation

Recovering Graphics Files

Virtual Machines, Network Forensics, and Live Acquisitions

E-Mail Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High-Tech Investigations

Expert Testimony in High-Tech Investigations

Ethics for the Expert Witness

Filters