312-49V11 · Question #168
In a computer forensics investigation, an investigator is dealing with a system that has been recently shut down. The data they need is of a non-volatile nature. Which type of data acquisition…
The correct answer is D. The investigator should use dead data acquisition because it is designed to collect unaltered data. Since the system is shut down and the required data is non-volatile (on storage), dead acquisition is appropriate. It minimizes changes to the target media and is designed to collect data from disks/USBs in a controlled manner (typically via imaging with write blockers).
Question
In a computer forensics investigation, an investigator is dealing with a system that has been recently shut down. The data they need is of a non-volatile nature. Which type of data acquisition methodology should the investigator adopt in this scenario and why?
Options
- AThe investigator should not perform any data acquisition as the system is already powered off
- BThe investigator should use either live or dead data acquisition as both methods can collect non-
- CThe investigator should use live data acquisition since it is intended to capture dynamic data from
- DThe investigator should use dead data acquisition because it is designed to collect unaltered data
How the community answered
(32 responses)- A3% (1)
- B9% (3)
- C13% (4)
- D75% (24)
Explanation
Since the system is shut down and the required data is non-volatile (on storage), dead acquisition is appropriate. It minimizes changes to the target media and is designed to collect data from disks/USBs in a controlled manner (typically via imaging with write blockers).
Topics
Community Discussion
No community discussion yet for this question.