312-49V11 · Question #41
As part of a forensic investigation into a suspected data breach at a corporate office, Detective Smith is tasked with gathering evidence from a seized hard drive. The detective aims to extract…
The correct answer is B. Dead acquisition. According to the CHFI v11 Data Acquisition Concepts and Rules, dead acquisition is the forensic process specifically used to extract non-volatile data from storage media such as hard drives, SSDs, USB devices, and memory cards after the system has been powered off. This method…
Question
As part of a forensic investigation into a suspected data breach at a corporate office, Detective Smith is tasked with gathering evidence from a seized hard drive. The detective aims to extract non-volatile data from the storage media in an unaltered manner to uncover any traces of unauthorized access or tampering. In Detective Smith's investigation of the corporate data breach, which data acquisition process involves extracting non-volatile data from the seized hard drive?
Options
- ADynamic acquisition
- BDead acquisition
- CVolatile acquisition
- DLive acquisition
How the community answered
(54 responses)- A2% (1)
- B83% (45)
- C6% (3)
- D9% (5)
Explanation
According to the CHFI v11 Data Acquisition Concepts and Rules, dead acquisition is the forensic process specifically used to extract non-volatile data from storage media such as hard drives, SSDs, USB devices, and memory cards after the system has been powered off. This method ensures that the evidence is collected in a forensically sound and unaltered manner, which is essential for maintaining evidence integrity and legal admissibility. In dead acquisition, the seized system is shut down, and the storage media is accessed using write blockers and forensic imaging tools to create a bit-by-bit copy of the disk. This allows investigators to safely analyze files, file system metadata, logs, deleted data, slack space, and unallocated space without modifying the original evidence. CHFI v11 emphasizes dead acquisition as the preferred approach when dealing with non-volatile data, particularly in corporate breach investigations where data integrity is critical.
Topics
Community Discussion
No community discussion yet for this question.