Forensics MT MC3

Help!

Question

Answer

Typically, a ______ acquisition is done on a computer seized during a police raid, for example.

static

🗑

If the computer has an encrypted drive, a ____ acquisition is done if the password or passphrase is available.

live

🗑

The most common and flexible data-acquisition method is _____________ ____ ____.

Disk-to-Image file copy

🗑

If your time is limited, consider using a logical acquisition or _____ acquisition data copy method.

sparse

🗑

EnCase Enterprise is set up with an Examiner workstation and a Secure Authentication for EnCase (____) workstation .

SAFE

🗑

SnapBack DatArrest can perform a data copy of an evidence drive in _____ ways

three

🗑

________ is the only automated disk-to-disk tool that allows you to copy data to a slightly smaller target drive than the original suspect's drive.

SnapCopy

🗑

SafeBack performs a _______ calculation for each sector copied to ensure data integrity.

SHA-256

🗑

____ ___ has developed the Rapid Action Imaging Device (RAID) to make forensically sound disk copies.

DIBS USA

🗑

Review the information in the table. When you are ready to quiz yourself you can hide individual columns or the entire table. Then you can click on the empty cells to reveal the answer. Try to recall what will be displayed before clicking the empty cell.

To hide a column, click on the column name.

To hide the entire table, click on the "Hide All" button.

You may also shuffle the rows of the table by clicking on the "Shuffle" button.

Or sort by any of the columns using the down arrow next to any column heading.
If you know all the data on any row, you can temporarily remove it by tapping the trash can to the right of the row.

Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.

Normal Size Small Size show me how

Created by: srentrop