Question 1

How can data acquisition be performed on an encrypted drive?

Accepted Answer

Data acquisition on whole disk

Question 2

Match the terms with the correct definitions?.
-Two or more disks combined into one large drive in several configurations for special needs

Accepted Answer

A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension 
A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension

Question 3

Match the terms with the correct definitions?.
-An area of a disk drive reserved for booting utilities and diagnostic programs; it is not visible to the computer's OS

Accepted Answer

A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension 
A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension

Question 4

​Which technology below is not a hot-swappable technology?

Accepted Answer

A) ​USB-3 
B) ​FireWire 1394A 
C) SATA 
D) IDE 
A) ​USB-3 
B) ​FireWire 1394A 
C) SATA 
D) IDE

Question 5

Which RAID type utilizes a parity bit and ​allows for the failure of one drive without losing data?

Accepted Answer

A) ​RAID 1 
B) ​RAID 2 
C) RAID 3 
D) RAID 5 
A) ​RAID 1 
B) ​RAID 2 
C) RAID 3 
D) RAID 5

Question 6

_____________ software is used in a Linux environment to mount and write data only to NTFS partitions.​

Accepted Answer

The answer of _____________ software is used in a Linux...

Question 7

Match the terms with the correct definitions?.
-An encryption technique that performs a sector-by-sector encryption of an entire drive; each sector is encrypted in its entirety, making it unreadable when copied with a static acquisition method

Accepted Answer

A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension 
A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension

Question 8

​Which option below is not a hashing function used for validation checks?

Accepted Answer

A) ​RC4 
B) ​MD5 
C) SHA-1 
D) CRC32 
A) ​RC4 
B) ​MD5 
C) SHA-1 
D) CRC32

Question 9

The Linux command _______ can be used to list the current disk devices connected to the computer.

Accepted Answer

A) ​ls -l 
B) ​fdisk -l 
C) show drives 
D) geom 
A) ​ls -l 
B) ​fdisk -l 
C) show drives 
D) geom

Question 10

In Linux, how is a specific partition acquired, as opposed to an entire drive?​

Accepted Answer

The partition number must be a

Question 11

Hardware and software errors or incompatibilities are a common problem when dealing with older hard drives.​

Accepted Answer

A) True 
 B)False

Question 12

Which option below is not a Linux Live CD meant for use as a digital forensics tool?​

Accepted Answer

A) ​Penguin Sleuth 
B) ​Kali Linux 
C) Ubuntu 
D) CAINE 
A) ​Penguin Sleuth 
B) ​Kali Linux 
C) Ubuntu 
D) CAINE

Question 13

The _______ command was developed by Nicholas Harbour of the Defense Computer Forensics Laboratory.

Accepted Answer

A) ​dd 
B) ​split 
C) dcfldd 
D) echo 
A) ​dd 
B) ​split 
C) dcfldd 
D) echo

Question 14

Describe RAID 3.

Accepted Answer

​RAID 3 uses data striping and dedicated

Question 15

The ___________ file type uses lossy compression to reduce file size and doesn't affect image quality when the file is restored and viewed.?

Accepted Answer

The answer of The ___________ file type uses lossy compression...

Question 16

FTK Imager software can acquire a drive's host protected area.​

Accepted Answer

A) True 
 B)False

Question 17

​Which open-source acquisition format is capable of producing compressed or uncompressed image files, and uses the .afd extension for segmented image files?

Accepted Answer

A) ​Advanced Forensics Disk 
B) ​Advanced Forensic Format 
C) Advanced Capture Image 
D) Advanced Open Capture 
A) ​Advanced Forensics Disk 
B) ​Advanced Forensic Format 
C) Advanced Capture Image 
D) Advanced Open Capture

Question 18

When two files with different contents generate the same digital fingerprint using a hashing function, a(n) ____________ has occurred.​

Accepted Answer

The answer of When two files with different contents generate...

Question 19

The ______________ imaging tool produces three proprietary formats: IDIF, IRBF, and IEIF.

Accepted Answer

The answer of The ______________ imaging tool produces three proprietary...

Question 20

_______ can be used with the dcfldd command to compare an image file to the original medium.

Accepted Answer

A) ​compare 
B) ​cmp 
C) vf 
D) imgcheck 
A) ​compare 
B) ​cmp 
C) vf 
D) imgcheck

How can data acquisition be performed on an encrypted drive?

Match the terms with the correct definitions?. -Two or more disks combined into one large drive in several configurations for special needs

Match the terms with the correct definitions?. -An area of a disk drive reserved for booting utilities and diagnostic programs; it is not visible to the computer's OS

Which technology below is not a hot-swappable technology?

Which RAID type utilizes a parity bit and allows for the failure of one drive without losing data?

_____________ software is used in a Linux environment to mount and write data only to NTFS partitions.

Match the terms with the correct definitions?. -An encryption technique that performs a sector-by-sector encryption of an entire drive; each sector is encrypted in its entirety, making it unreadable when copied with a static acquisition method

Which option below is not a hashing function used for validation checks?

The Linux command _______ can be used to list the current disk devices connected to the computer.

In Linux, how is a specific partition acquired, as opposed to an entire drive?

Hardware and software errors or incompatibilities are a common problem when dealing with older hard drives.

Which option below is not a Linux Live CD meant for use as a digital forensics tool?

The _______ command was developed by Nicholas Harbour of the Defense Computer Forensics Laboratory.

Describe RAID 3.

The ___________ file type uses lossy compression to reduce file size and doesn't affect image quality when the file is restored and viewed.?

FTK Imager software can acquire a drive's host protected area.

Which open-source acquisition format is capable of producing compressed or uncompressed image files, and uses the .afd extension for segmented image files?

When two files with different contents generate the same digital fingerprint using a hashing function, a(n) ____________ has occurred.

The ______________ imaging tool produces three proprietary formats: IDIF, IRBF, and IEIF.

_______ can be used with the dcfldd command to compare an image file to the original medium.

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Exam 3: Data Acquisition

How can data acquisition be performed on an encrypted drive?

Match the terms with the correct definitions?. -Two or more disks combined into one large drive in several configurations for special needs

Match the terms with the correct definitions?. -An area of a disk drive reserved for booting utilities and diagnostic programs; it is not visible to the computer's OS

​Which technology below is not a hot-swappable technology?

Which RAID type utilizes a parity bit and ​allows for the failure of one drive without losing data?

_____________ software is used in a Linux environment to mount and write data only to NTFS partitions.​

Match the terms with the correct definitions?. -An encryption technique that performs a sector-by-sector encryption of an entire drive; each sector is encrypted in its entirety, making it unreadable when copied with a static acquisition method

​Which option below is not a hashing function used for validation checks?

The Linux command _______ can be used to list the current disk devices connected to the computer.

In Linux, how is a specific partition acquired, as opposed to an entire drive?​

Hardware and software errors or incompatibilities are a common problem when dealing with older hard drives.​

Which option below is not a Linux Live CD meant for use as a digital forensics tool?​

The _______ command was developed by Nicholas Harbour of the Defense Computer Forensics Laboratory.

Describe RAID 3.

The ___________ file type uses lossy compression to reduce file size and doesn't affect image quality when the file is restored and viewed.?

FTK Imager software can acquire a drive's host protected area.​

​Which open-source acquisition format is capable of producing compressed or uncompressed image files, and uses the .afd extension for segmented image files?

When two files with different contents generate the same digital fingerprint using a hashing function, a(n) ____________ has occurred.​

The ______________ imaging tool produces three proprietary formats: IDIF, IRBF, and IEIF.

_______ can be used with the dcfldd command to compare an image file to the original medium.

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Which technology below is not a hot-swappable technology?

Which RAID type utilizes a parity bit and allows for the failure of one drive without losing data?

_____________ software is used in a Linux environment to mount and write data only to NTFS partitions.

Which option below is not a hashing function used for validation checks?

In Linux, how is a specific partition acquired, as opposed to an entire drive?

Hardware and software errors or incompatibilities are a common problem when dealing with older hard drives.

Which option below is not a Linux Live CD meant for use as a digital forensics tool?

FTK Imager software can acquire a drive's host protected area.

Which open-source acquisition format is capable of producing compressed or uncompressed image files, and uses the .afd extension for segmented image files?

When two files with different contents generate the same digital fingerprint using a hashing function, a(n) ____________ has occurred.