Assignment 04
Q1. Write down any three digital forensics acquisition image file formats.
Three formats
Raw format
Proprietary formats
Advanced Forensics Format (AFF)
Q2. Why dcfldd is preferred over dd tool.
dd (“data dump”) command
1. Requires more advanced skills than average user
2. Does not compress data
dcfldd additional functions
3. Specify hex patterns or text for clearing disk space
4. Log errors to an output file for analysis and review
5. Use several hashing options
6. Refer to a status display indicating the progress of the acquisition in bytes
7. Split data acquisitions into segmented volumes with numeric extensions
8. Verify acquired data with original disk or media data
Q3. Explain the difference between logical acquisition and sparse acquisition.
Logical Acquisition:
Time: Logical acquisition can take several hours, but it is generally faster compared to other
acquisition methods.
Focus: It captures only specific files that are relevant to the case or investigation.
Purpose: Logical acquisition is often used when time is limited and investigators need to quickly
obtain specific files or evidence for analysis or preservation.
Sparse Acquisition:
Data Collection: Sparse acquisition focuses on collecting fragments of unallocated or deleted data.
It aims to retrieve data that may not be readily accessible or visible through normal file system
access.
.
, Purpose: Sparse acquisition is particularly useful when trying to recover deleted or hidden data
that may be relevant to the investigation.
Q4. Write down the four methods of data collection.
Four methods of data collection
1. Creating a disk-to-image file
2. Creating a disk-to-disk
3. Creating a logical disk-to-disk or disk-to-data file
4. Creating a sparse data copy of a file or folder
Q5. How anti-forensic techniques hinder forensic investigations. What do you know about
such techniques.
1. Hide Data
2. Mislead
3. Destroy data
Q6. What are the differences between POP and IMAP.
POP (Post Office Protocol) and IMAP (Internet Message Access Protocol) are two commonly used
email protocols.
1. Message Storage: When you use POP, your email messages are typically downloaded from the mail
server to your local device, and the server copy is usually deleted unless you specifically configure it
to keep a copy. With IMAP, your email messages are stored on the mail server, and you access them
remotely while synchronizing changes between the server and your device.
2. Synchronization: POP is a "download-and-delete" protocol, meaning that once your email is
downloaded, it resides only on your device. Any changes you make (such as organizing folders or
marking messages as read) are only reflected locally. IMAP, on the other hand, synchronizes your
email across multiple devices. Actions performed on one device (e.g., deleting or moving messages)
are reflected on all devices connected to the same IMAP account.
3. Multiple Device Access: POP is more suitable for accessing email from a single device, IMAP is
more advantageous as it keeps all devices in sync with the server.
.
Q1. Write down any three digital forensics acquisition image file formats.
Three formats
Raw format
Proprietary formats
Advanced Forensics Format (AFF)
Q2. Why dcfldd is preferred over dd tool.
dd (“data dump”) command
1. Requires more advanced skills than average user
2. Does not compress data
dcfldd additional functions
3. Specify hex patterns or text for clearing disk space
4. Log errors to an output file for analysis and review
5. Use several hashing options
6. Refer to a status display indicating the progress of the acquisition in bytes
7. Split data acquisitions into segmented volumes with numeric extensions
8. Verify acquired data with original disk or media data
Q3. Explain the difference between logical acquisition and sparse acquisition.
Logical Acquisition:
Time: Logical acquisition can take several hours, but it is generally faster compared to other
acquisition methods.
Focus: It captures only specific files that are relevant to the case or investigation.
Purpose: Logical acquisition is often used when time is limited and investigators need to quickly
obtain specific files or evidence for analysis or preservation.
Sparse Acquisition:
Data Collection: Sparse acquisition focuses on collecting fragments of unallocated or deleted data.
It aims to retrieve data that may not be readily accessible or visible through normal file system
access.
.
, Purpose: Sparse acquisition is particularly useful when trying to recover deleted or hidden data
that may be relevant to the investigation.
Q4. Write down the four methods of data collection.
Four methods of data collection
1. Creating a disk-to-image file
2. Creating a disk-to-disk
3. Creating a logical disk-to-disk or disk-to-data file
4. Creating a sparse data copy of a file or folder
Q5. How anti-forensic techniques hinder forensic investigations. What do you know about
such techniques.
1. Hide Data
2. Mislead
3. Destroy data
Q6. What are the differences between POP and IMAP.
POP (Post Office Protocol) and IMAP (Internet Message Access Protocol) are two commonly used
email protocols.
1. Message Storage: When you use POP, your email messages are typically downloaded from the mail
server to your local device, and the server copy is usually deleted unless you specifically configure it
to keep a copy. With IMAP, your email messages are stored on the mail server, and you access them
remotely while synchronizing changes between the server and your device.
2. Synchronization: POP is a "download-and-delete" protocol, meaning that once your email is
downloaded, it resides only on your device. Any changes you make (such as organizing folders or
marking messages as read) are only reflected locally. IMAP, on the other hand, synchronizes your
email across multiple devices. Actions performed on one device (e.g., deleting or moving messages)
are reflected on all devices connected to the same IMAP account.
3. Multiple Device Access: POP is more suitable for accessing email from a single device, IMAP is
more advantageous as it keeps all devices in sync with the server.
.
