Brian needs to acquire data from RAID storage. Which of the following acquisition methods is recommended to retrieve only the data relevant to the investigation?

The correct answer is B. Sparse or Logical Acquisition. Sparse or Logical Acquisition copies only specific files, folders, or allocated data relevant to the investigation rather than imaging the entire physical drive or RAID set. For RAID arrays, a full bit-stream image requires complex RAID reconstruction, is time-consuming, and capt

Submitted by yasin.bd· Apr 18, 2026Disk Forensics

Question

Options

AStatic Acquisition
BSparse or Logical Acquisition
CBit-stream disk-to-disk Acquisition
DBit-by-bit Acquisition

How the community answered

(16 responses)

B
94% (15)
C
6% (1)

Explanation

Sparse or Logical Acquisition copies only specific files, folders, or allocated data relevant to the investigation rather than imaging the entire physical drive or RAID set. For RAID arrays, a full bit-stream image requires complex RAID reconstruction, is time-consuming, and captures enormous amounts of irrelevant data. Logical acquisition is the practical and recommended approach when investigators know what data they need and want to avoid the overhead of imaging multi-terabyte RAID volumes.

Topics

#Data acquisition#RAID forensics#Logical acquisition#Forensic imaging

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice