Data Acquisition and Duplication
6 practice questions under this official exam objective (312-49v10) — each with the community-verified answer, a full option-by-option explanation and instant feedback.
Sparse or Bit-Stream Acquisition for Email Files and Deleted Fragments?
Sparse acquisition is the CHFI-appropriate choice when an investigator must recover selected email files plus unallocated deleted fragments from a lar
Remote Linux RAM Acquisition with LiME and Netcat?
Remote Linux RAM acquisition is performed by loading LiME on the suspect host with a TCP export path and receiving the stream with Netcat on the foren
Which Acquisition Type Fits a Cloud-Based Incident Investigation?
Cloud-based incident response calls for live acquisition to capture volatile artifacts, including cloud-service data and open unencrypted containers,
What Is the First Forensic Step for an Android Smartwatch?
In an IoT smartwatch investigation where the paired phone is unavailable, the first forensic step is to generate a forensic image of the smartwatch ev
Which Tool Restores Files from a Damaged MBR?
When a failed OS install leaves the master boot record or partition sector damaged, a file-recovery utility must reconstruct partitions and carve file
Which RAID Gives Different Volume and Disk Images
When a Hardware RAID volume is imaged through its controller, the resulting image only matches separate per-disk images in mirroring configurations. T