Question 1

​What is the dd command?

Accepted Answer

The dd command, or data dump command, ca

Question 2

Match the terms with the correct definitions?.
-?A data acquisition method used when a suspect drive is write-protected and can't be altered

Accepted Answer

A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension 
A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension

Question 3

Match the terms with the correct definitions?.
-?A ProDiscover Group file, which includes instructions for how ProDiscover should load each physical disk's image data

Accepted Answer

A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension 
A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension

Question 4

_______ is the utility used by the ProDiscover program for remote access.

Accepted Answer

A) ​SubSe7en 
B) ​l0pht 
C) PDServer 
D) VNCServer 
A) ​SubSe7en 
B) ​l0pht 
C) PDServer 
D) VNCServer

Question 5

​How does remote access work in EnCase Enterprise software?

Accepted Answer

In EnCase Enterprise, the remote access

Question 6

Match the terms with the correct definitions?.
-?A data acquisition method that captures only specific files of interest to the case or specific types of files, such as Outlook .pst files

Accepted Answer

A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension 
A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension

Question 7

_______ creates a virtual volume of a RAID image file, and then makes repairs on the virtual volume, which can then be restored to the original RAID.

Accepted Answer

A) Runtime Software​ 
B) ​RaidRestore 
C) R-Tools R-Studio 
D) FixitRaid 
A) Runtime Software​ 
B) ​RaidRestore 
C) R-Tools R-Studio 
D) FixitRaid

Question 8

?To create a new primary partition within the fdisk interactive utility, which letter should be typed?

Accepted Answer

A) ?c 
B) ?p 
C) l 
D) n 
A) ?c 
B) ?p 
C) l 
D) n

Question 9

Match the terms with the correct definitions?.
-?A data acquisition method that captures only specific files of interest to a case, but also collects fragments of unallocated (deleted) data

Accepted Answer

A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension 
A) Advanced Forensic Format (AFF) 
B) Host protected area (HP
A)  
C) Live acquisitions 
D) Logical acquisitions 
E) Raw format
F)Redundant array of independent disks (RAI
D) 
G)Sparse acquisition
H)Static acquisitions
I)Whole disk encryption
J).pdg extension

Question 10

Within the fdisk interactive menu, what character should be entered to view existing partitions?​

Accepted Answer

A) ​l 
B) ​p 
C) o 
D) d 
A) ​l 
B) ​p 
C) o 
D) d

What is the dd command?

Match the terms with the correct definitions?. -?A data acquisition method used when a suspect drive is write-protected and can't be altered

Match the terms with the correct definitions?. -?A ProDiscover Group file, which includes instructions for how ProDiscover should load each physical disk's image data

_______ is the utility used by the ProDiscover program for remote access.

How does remote access work in EnCase Enterprise software?

Match the terms with the correct definitions?. -?A data acquisition method that captures only specific files of interest to the case or specific types of files, such as Outlook .pst files

_______ creates a virtual volume of a RAID image file, and then makes repairs on the virtual volume, which can then be restored to the original RAID.

?To create a new primary partition within the fdisk interactive utility, which letter should be typed?

Match the terms with the correct definitions?. -?A data acquisition method that captures only specific files of interest to a case, but also collects fragments of unallocated (deleted) data

Within the fdisk interactive menu, what character should be entered to view existing partitions?

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

Exam 3: Data Acquisition

​What is the dd command?

Match the terms with the correct definitions?. -?A data acquisition method used when a suspect drive is write-protected and can't be altered

Match the terms with the correct definitions?. -?A ProDiscover Group file, which includes instructions for how ProDiscover should load each physical disk's image data

_______ is the utility used by the ProDiscover program for remote access.

​How does remote access work in EnCase Enterprise software?

Match the terms with the correct definitions?. -?A data acquisition method that captures only specific files of interest to the case or specific types of files, such as Outlook .pst files

_______ creates a virtual volume of a RAID image file, and then makes repairs on the virtual volume, which can then be restored to the original RAID.

?To create a new primary partition within the fdisk interactive utility, which letter should be typed?

Match the terms with the correct definitions?. -?A data acquisition method that captures only specific files of interest to a case, but also collects fragments of unallocated (deleted) data

Within the fdisk interactive menu, what character should be entered to view existing partitions?​

Understanding the Digital Forensics Profession and Investigations

The Investigators Office and Laboratory

Processing Crime and Incident Scenes

Working With Windows and Cli Systems

Current Computer Forensics Tools

Macintosh and Linux Boot Processes and File Systems

Recovering Graphics Files

Computer Forensics Analysis and Validation

Virtual Machine and Cloud Forensics

Live Acquisitions and Network Forensics

Email Investigations

Cell Phone and Mobile Device Forensics

Report Writing for High Tech Investigations

Expert Testimony in High Tech Investigations

Ethics for the Investigator and Expert Witness

Filters

What is the dd command?

How does remote access work in EnCase Enterprise software?

Within the fdisk interactive menu, what character should be entered to view existing partitions?