IST 454 - Chapter 3 | UPDATED Questions with 100%
Verified Answers
Q1: Data acquisition
A: is the process of copying data.
Q2: Raw format
A: a data acquisition format that creates simple sequential flat files of a suspect drive or data
set.
Q3: Proprietary Formats
A: typically offer several features that complement the vendor's analysis tool
Q4: Dr. Simson L Garfinkel developed an open source acquisition
format called
A: Advanced Forensic Format
Q5: Two types of acquisitions
A: static
live
Q6: Static acquisition
A: done on a computer seized during a police raid
Q7: If a computer has an encrypted drive, _________ is done if the
passphrase is available.
A: live acquistion
Q8: Creating a __________ is the most common method and offers the
most flexibility for your investigation. With this method, you
can make one or many copies of a suspect drive.
A: disk-to-image
Q9: Collecting evidence from a large drive can take several hours.
If your time is limited, consider using _____________________ or
____________ data copy method.
A: logical acquisition
sparse acquisition
Q10: Microsoft has added _______________________ with BitLocker to its
newer operating systems, such as Windows 7 and 8, which
Verified Answers
Q1: Data acquisition
A: is the process of copying data.
Q2: Raw format
A: a data acquisition format that creates simple sequential flat files of a suspect drive or data
set.
Q3: Proprietary Formats
A: typically offer several features that complement the vendor's analysis tool
Q4: Dr. Simson L Garfinkel developed an open source acquisition
format called
A: Advanced Forensic Format
Q5: Two types of acquisitions
A: static
live
Q6: Static acquisition
A: done on a computer seized during a police raid
Q7: If a computer has an encrypted drive, _________ is done if the
passphrase is available.
A: live acquistion
Q8: Creating a __________ is the most common method and offers the
most flexibility for your investigation. With this method, you
can make one or many copies of a suspect drive.
A: disk-to-image
Q9: Collecting evidence from a large drive can take several hours.
If your time is limited, consider using _____________________ or
____________ data copy method.
A: logical acquisition
sparse acquisition
Q10: Microsoft has added _______________________ with BitLocker to its
newer operating systems, such as Windows 7 and 8, which
