ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 45 - 212-82 discussion

Report
Export

Ruben, a crime investigator, wants to retrieve all the deleted files and folders in the suspected media without affecting the original files. For this purpose, he uses a method that involves the creation of a cloned copy of the entire media and prevents the contamination of the original media.

Identify the method utilized by Ruben in the above scenario.

A.
Sparse acquisition
Answers
A.
Sparse acquisition
B.
Bit-stream imaging
Answers
B.
Bit-stream imaging
C.
Drive decryption
Answers
C.
Drive decryption
D.
Logical acquisition
Answers
D.
Logical acquisition
Suggested answer: B

Explanation:

Bit-stream imaging is the method utilized by Ruben in the above scenario. Bit-stream imaging is a method that involves creating a cloned copy of the entire media and prevents the contamination of the original media. Bit-stream imaging copies all the data on the media, including deleted files and folders, hidden partitions, slack space, etc., at a bit level. Bit-stream imaging preserves the integrity and authenticity of the digital evidence and allows further analysis without affecting the original media. Sparse acquisition is a method that involves creating a partial copy of the media by skipping empty sectors or blocks. Drive decryption is a method that involves decrypting an encrypted drive or partition using a password or a key. Logical acquisition is a method that involves creating a copy of the logical files and folders on the media using file system commands.

asked 18/09/2024
João Faria
42 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first