CHFI Evidence Acquisition and Duplication Practice Question
You are a forensic investigator responding to a data breach at a financial institution. The compromised server is a Windows Server 2019 running a custom trading application. The server is still powered on and connected to the production network. The incident response team has instructed you to acquire forensic evidence while minimizing downtime. The server has 2 TB of storage with 500 GB used. You have a forensic workstation with a write-blocker and an empty 2 TB external drive. The server's RAM is 64 GB. You need to acquire both volatile data (RAM) and a forensic image of the disk. However, the legal team requires a verified bit-for-bit copy with cryptographic hash verification. Additionally, the server's performance is critical; acquiring RAM via network is not feasible due to bandwidth constraints. Which of the following is the best course of action?
⚠ Common exam trap
EC-Council often tests the misconception that network-based RAM acquisition is always feasible or that shutting down the server is acceptable, but the trap here is that candidates overlook the bandwidth constraint and the critical need to preserve volatile data before disk imaging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run win32dd locally to capture RAM to the external drive, then use FTK Imager over the network to create a physical disk image with verification.
It prioritizes capturing volatile RAM first using win32dd (a memory acquisition tool) locally to the external drive, which preserves the most volatile evidence before any shutdown or network transfer. After RAM capture, FTK Imager over the network creates a verified physical disk image, satisfying the legal requirement for cryptographic hash verification while minimizing downtime. This approach avoids the risk of losing RAM data (as in shutdown) and avoids bandwidth constraints (as in network RAM acquisition).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shut down the server, remove the disk, connect it to a write-blocker, and acquire the disk image using FTK Imager; RAM is lost but disk acquisition is verified.
Why it's wrong here
This approach violates the order of volatility. In live incident response, RAM must be captured first because it contains active processes, open network connections, decrypted data, and potential malware injection. Shutting down the server destroys that volatile evidence and may trigger anti-forensic mechanisms, while also causing unflushed disk caches to be lost. Disk acquisition afterward is fine, but only after memory has been collected.
- ✗
Use FTK Imager over the network to acquire RAM first, then use dd to image the disk to the external drive via write-blocker.
Why it's wrong here
Acquiring RAM over the network is inherently slow and alters the target system's state, especially with 64 GB of RAM where the transfer could take hours and risk lockups. Furthermore, using dd to image the disk to an external drive does not automatically compute cryptographic hashes, so you must run a separate hashing step that introduces an integrity gap. Proper forensic procedure requires hash verification during acquisition to prove the image is bit-for-bit identical to the source.
- ✓
Run win32dd locally to capture RAM to the external drive, then use FTK Imager over the network to create a physical disk image with verification.
Why this is correct
This is the correct order of volatility. Running win32dd locally captures RAM quickly to an external device, minimizing the time that volatile data is at risk, and it preserves a raw memory image for later analysis. After that, FTK Imager can acquire a physical disk image over the network and automatically generate hash values (e.g., MD5/SHA1) to verify the integrity of the image at acquisition time. This combines fast volatile capture with network-acquired disk imaging that includes built-in verification.
- ✗
Use dd over netcat to acquire RAM and disk simultaneously, then compute hashes separately.
Why it's wrong here
Using dd over netcat to acquire RAM is technically unreliable because RAM is not a block device, and dd will read through the address space in a way that may produce inconsistent or partial data while the system is running. Simultaneously acquiring disk and RAM also introduces I/O contention and potential data race conditions. Computing cryptographic hashes separately after the transfer, rather than during acquisition, creates a window where bit errors could go undetected and violates the forensic requirement for immediate verification.
Go deeper
Related to this question
Learn chapter
Legal and Ethical Issues in Digital Forensics
Key term
Memory Acquisition
Memory acquisition is the process of capturing the contents of a computer's volatile memory to preserve data for forensic analysis and incident response.
Key term
Disk Imaging
Disk imaging is the process of creating an exact, bit-for-bit copy of a storage drive, preserving all data, deleted files, and unallocated space for forensic analysis or system recovery.
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.