Computer Forensics And Investigations Exam Script Full Questions And Correct Answers Graded A+

COMPUTER FORENSICS AND
INVESTIGATIONS EXAM SCRIPT FULL
QUESTIONS AND CORRECT ANSWERS
GRADED A+

●● The most common and time-consuming technique for preserving
evidence is creating a duplicate copy of your disk-to-image file. (T/F)
Answer: True


●● Some acquisition tools don't copy data in the host protected area
(HPA) of a disk drive. (T/F)
Answer: True


●● FTK Imager requires that you use a device such as a USB dongle for
licensing. (T/F)
Answer: True


●● Unlike RAID 0, RAID 3 stripes tracks across all disks that make up
one volume. (T/F)
Answer: False

, ●● One major disadvantage of _________ format acquisitions is the
inability to share an image between different vendors' computer
forensics analysis tools.
Answer: proprietary


●● Typically, a(n) __________ acquisition is done on a computer seized
during a police raid, for example.
Answer: static


●● If the computer has an encrypted drive, a ________ acquisition is
done if he password or passphrase is available.
Answer: live


●● The most common and flexible data-acquisition method is
_________.
Answer: disk-to-image file


●● Older Microsoft disk compression tools, such as DoubleSpace or
______________, eliminate only slack disk space between files.
Answer: DriveSpace


●● If your time is limited, consider using a logical acquisition or
______________ acquisition data copy method.
Answer: Sparse