Discussion
Which forensic acquisition is preferred when the system is suspected to contain full-disk encryption ?
Answer: A
The preferred method is live acquisition.
With full-disk encryption, the data on the disk is readable only while the system is running with the volume unlocked. If the machine is switched off and imaged in the usual way, the examiner gets only ciphertext and needs the password or recovery key. A live acquisition captures the decrypted data while it is accessible, together with the RAM contents, which may hold the encryption keys themselves.
Offline imaging (dead-box acquisition) is exactly the approach that loses access to encrypted data. Sparse and logical acquisitions only reduce what is collected; they do not address encryption, and they still have to be done while the system is live to be readable.
Post your comment
Please log in or register to post a comment.
Examination Categories
- SSC Exams
- Banking Exams
- Teaching Exams
- Civil Services Exams
- Railways Exams
- Engineering Recruitment Exams
- Defence Exams
- State Government Exams
- Police Exams
- Insurance Exams
- Nursing Exams
- Other Government Exams
- NRA CET
- PG Entrance Exams
- Campus Placement
- MBA Entrance Exams
- CUET and UG Entrance
- Judiciary Exams
- Regulatory Body Exams
- Software Development