What type of acquisition is done if the computer has an encrypted?If the computer has an encrypted drive, a live acquisition is done if the password or passphrase is not available.
What is sparse acquisition method?Sparse Acquisition
Sparse acquisition is similar to logical acquisition. Through this method, investigators can collect fragments of unallocated (deleted) data. This method is very useful when it is not necessary to inspect the entire drive.
What is a data acquisition method used when a suspect computer can't be shut down to perform a static acquisition?live acquisitions. A data acquisition method used when a suspect computer can't be shut down to perform a static acquisition. Data is collected from the local computer or over a remote network connection. The captured data might be altered during the acquisition because it's not write-protected.
What is the most common and time consuming method of data acquisition?The most common and time-consuming technique for preserving evidence is creating a duplicate copy of your evidence image file. Many acquisition tools don't copy data in the host protected area (HPA) of a disk drive.
|