GCFA · Question #231
Which of the following is used to back up forensic evidences or data folders from the network or locally attached hard disk drives?
The correct answer is C. FAR system. The FAR (Forensic Archive and Recovery) system is a forensic tool specifically designed to back up evidence and data folders from both network-connected and locally attached hard disk drives.
Question
Which of the following is used to back up forensic evidences or data folders from the network or locally attached hard disk drives?
Options
- AWinHex
- BDevice Seizure
- CFAR system
- DVedit
How the community answered
(20 responses)- A5% (1)
- B15% (3)
- C75% (15)
- D5% (1)
Why each option
The FAR (Forensic Archive and Recovery) system is a forensic tool specifically designed to back up evidence and data folders from both network-connected and locally attached hard disk drives.
WinHex is a hexadecimal disk and file editor used to analyze and manually edit raw binary data, not a tool designed for automated forensic evidence backup from hard drives.
Device Seizure is a forensic acquisition tool focused on extracting and analyzing data from mobile devices such as cell phones and PDAs, not hard disk drives on a network or local system.
The FAR system is purpose-built for forensic evidence preservation, allowing investigators to create verified, forensically sound backups of data folders sourced from network shares or directly attached hard drives. It maintains chain-of-custody integrity by producing verifiable copies suitable for use as legal evidence. This targeted backup capability for both local and network storage distinguishes it from general-purpose disk editors or mobile forensic tools.
Vedit is a text and binary file editor used for viewing and modifying large files, and it lacks the forensic backup and chain-of-custody features required for evidence preservation from hard drives.
Concept tested: Forensic backup tools for hard drive evidence acquisition
Topics
Community Discussion
No community discussion yet for this question.