click below
click below
Normal Size Small Size show me how
Forensics MT MC3
| Question | Answer |
|---|---|
| Typically, a ______ acquisition is done on a computer seized during a police raid, for example. | static |
| If the computer has an encrypted drive, a ____ acquisition is done if the password or passphrase is available. | live |
| The most common and flexible data-acquisition method is _____________ ____ ____. | Disk-to-Image file copy |
| If your time is limited, consider using a logical acquisition or _____ acquisition data copy method. | sparse |
| EnCase Enterprise is set up with an Examiner workstation and a Secure Authentication for EnCase (____) workstation . | SAFE |
| SnapBack DatArrest can perform a data copy of an evidence drive in _____ ways | three |
| ________ is the only automated disk-to-disk tool that allows you to copy data to a slightly smaller target drive than the original suspect's drive. | SnapCopy |
| SafeBack performs a _______ calculation for each sector copied to ensure data integrity. | SHA-256 |
| ____ ___ has developed the Rapid Action Imaging Device (RAID) to make forensically sound disk copies. | DIBS USA |