Digital Forensic Certification Practice Exam

Which data acquisition method did Tyler utilize by collecting files and fragments of deleted data?

1. Sparse acquisition

2. Logical acquisition

3. Physical acquisition

4. Partial acquisition

The correct answer is: Sparse acquisition

The method utilized by Tyler to collect files and fragments of deleted data is indeed sparse acquisition. This approach is specifically designed to target only specific types of data, often including deleted files or fragments thereof, without acquiring the entire data set from the storage device. Sparse acquisition allows forensic investigators to focus on particular areas of interest—such as fragments and deleted files that could contain crucial evidence—while avoiding the overhead and time associated with collecting and processing the entire data store. This makes it particularly useful when the forensic goal is to retrieve certain pieces of information that are known to be critical for an investigation. In contrast, the other methods mentioned serve different purposes; for example, logical acquisition involves capturing only active files and folders from the file system, without retrieving unallocated space or deleted data. Physical acquisition entails creating a bit-for-bit copy of the entire storage medium, including all files, fragments, and unallocated space, which goes beyond the intent to gather only specific data items. Partial acquisition can refer to any targeted data collection that doesn't fit neatly into the other categories but is not specifically aimed at fragmented or deleted data. Thus, sparse acquisition is the most accurate term for the process described in Tyler's method.