CHFI Evidence Acquisition and Duplication Practice Question

During a forensic acquisition, you notice that the target drive has bad sectors. What is the best approach to acquire the drive?

⚠ Common exam trap

EC-Council often tests the misconception that dd can handle bad sectors by adjusting block size, but the trap is that dd lacks any error recovery algorithm and will simply fail or produce incomplete data, whereas ddrescue is the proper tool for forensic acquisition of damaged media.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use ddrescue to recover as much data as possible

B is correct because ddrescue is specifically designed to handle media with bad sectors by using a sophisticated read-retry algorithm that logs errors and attempts recovery from multiple angles, including reverse reads and splitting the drive into good and bad regions. Unlike dd, which will abort or produce corrupted output on encountering a bad sector, ddrescue maximizes data recovery while preserving a map of unrecoverable areas.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use dd with a higher block size to skip bad sectors
Why it's wrong here
Raising dd's block size merely increases the size of each read request; it does not instruct dd to skip or bypass bad sectors. dd's default behavior is to terminate immediately when a read error occurs, so a single unrecoverable sector will stop the acquisition and leave the rest of the drive unacquired. Even with conv=noerror,sync, a larger block size can amplify data loss because one bad sector poisons an entire block, making this an unreliable method for forensic imaging of failing media.
✓
Use ddrescue to recover as much data as possible
Why this is correct
ddrescue is purpose-built for imaging failing or damaged storage devices. It reads the drive in a single pass, records errors in a logfile, and then retries difficult sectors with increasingly fine-grained reads, recovering the maximum amount of data while preserving a documented map of the damage. Because it can be re-run and continues from the logfile, it is the forensically sound choice when the target drive exhibits read errors.
✗
Use FTK Imager and ignore the errors
Why it's wrong here
FTK Imager, like most GUI imaging tools, will display an error and may continue creating an image with unreadable sectors filled with placeholders, but simply ignoring these errors produces an incomplete and unreliable evidence copy. A forensic image must be a complete, bit-for-bit representation with any read failures documented, because evidence that is missing or untracked cannot be authenticated or explained in court. Ignoring errors also hides the location and extent of damaged areas, undermining the integrity of the entire acquisition.
✗
Perform a physical acquisition by removing platters
Why it's wrong here
Removing platters from a drive is a destructive, invasive procedure that typically requires a cleanroom and specialized equipment, and it permanently alters the original evidence. It is not a forensic acquisition method; even with platter removal, the data still must be read with specialized hardware, and the process risks head crashes or static damage that can destroy the very data being preserved. A forensic acquisition should be non-destructive, and this option should only be considered as a last resort after all logical and physical imaging attempts have failed, not as a routine response to bad sectors.

Go deeper

CHFI Evidence Acquisition and Duplication Practice Question

Why each option matters

Option-by-option breakdown

Related to this question