CHFI Evidence Acquisition and Duplication Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Acquire each disk individually, then reconstruct the array using software

  Why this is correct

  Each physical disk must be imaged independently using a proper write blocker to preserve the raw device contents, including RAID metadata, superblocks, and any data sitting outside the array's logical volume. After all disks are imaged, a forensic RAID reconstruction tool (or mdadm with the correct parameters) can reassemble the logical volume by using the known stripe size, parity rotation, and disk order without needing the original controller. This preserves the exact state of the array and avoids the risk of the controller writing configuration changes during acquisition.

• ✗

  Acquire only one disk because RAID 5 can be reconstructed from a single disk

  Why it's wrong here

  A RAID 5 volume distributes data and parity across every member disk in stripes, so no single disk contains a complete file system or a contiguous copy of the volume contents. With only one member disk, you can read individual stripes but cannot reconstruct the original linear block sequence or compute the missing data from the striped parity blocks. A single disk is enough to identify fragments, but it is not sufficient to recover the logical volume as a whole.

• ✗

  Use a hardware write blocker that supports RAID

  Why it's wrong here

  A hardware write blocker is a forensic device that intercepts write commands at the ATA/SCSI command level to prevent any modification to a single attached physical drive; it has no capability to aggregate multiple drives into a RAID volume or emulate the controller's stripe and parity logic. While you should use a write blocker for each disk in its own individual acquisition, the blocker on its own cannot produce a logical RAID image. Software reconstruction is still required after the blocking writes to each disk are complete.

• ✗

  Connect the RAID array to a similar controller and acquire as a single drive

  Why it's wrong here

  Connecting the drives to a 'similar' RAID controller is unreliable because foreign RAID metadata is often tied to the exact controller vendor, model, firmware, and configuration (such as the array's record type and disk order), and the controller may refuse to import the array or, worse, automatically rebuild or rewrite metadata. Additionally, a working controller would present the logical volume as a single block device, which means you would not capture underlying disk geometry, unallocated areas, or RAID metadata from each member disk—information that can be forensic-critical. Since the original controller is unavailable, a similar one still lacks the original configuration and cannot be trusted to produce a forensically sound image.

Go deeper

Related to this question