Discussion
Which evidence acquisition method ensures bit-level replication including slack space and unallocated clusters ?
Answer: B
The method is physical acquisition.
A physical acquisition makes a bit-stream image of the whole storage device, sector by sector, regardless of what the file system says is in use. It therefore captures file slack, unallocated clusters, deleted files and hidden areas, which is what an examiner needs for carving and recovering deleted evidence.
A logical acquisition copies only the files and folders the file system presents, so slack and unallocated space are lost. A sparse acquisition collects selected files plus some fragments of unallocated data, and a targeted acquisition collects only chosen items. Neither is a complete bit-level copy.
Post your comment
Please log in or register to post a comment.
Examination Categories
- SSC Exams
- Banking Exams
- Teaching Exams
- Civil Services Exams
- Railways Exams
- Engineering Recruitment Exams
- Defence Exams
- State Government Exams
- Police Exams
- Insurance Exams
- Nursing Exams
- Other Government Exams
- NRA CET
- PG Entrance Exams
- Campus Placement
- MBA Entrance Exams
- CUET and UG Entrance
- Judiciary Exams
- Regulatory Body Exams
- Software Development