A Computer Hacking Forensics Investigator (CHFI) has been asked to retrieve specific email files from a large RAID server after a data breach. Additionally, fragments of unallocated (deleted) data are also required. However, there is a severe constraint on time and resources. Considering these requirements, which type of data acquisition should the investigator primarily focus on?
In scenarios where there are severe constraints on time and resources, a sparse acquisition is the most efficient method. Sparse acquisition focuses on collecting only specific files and fragments of unallocated (deleted) data without having to inspect the entire drive. This approach meets the requirements of retrieving specific email files and unallocated data fragments, making it ideal for the constraints mentioned.
C < https://info-savvy.com/data-acquisition-methods/#:~:text=2.-,Sparse%20Acquisition,to%20inspect%20the%20entire%20drive.
Sparse acquisition is similar to logical acquisition. Through this method, investigators can collect fragments of unallocated (deleted) data. This method is useful when it is not necessary to inspect the entire drive.