Computer Hacking Forensic Investigator (CHFI v10) — Question 384

Which of the following methods of mobile device data acquisition captures all the data present on the device, as well as all deleted data and access to unallocated space?

Answer options

• A. Direct acquisition
• B. Physical acquisition
• C. Logical acquisition
• D. Manual acquisition

Correct answer: B

Explanation

The correct answer is B, Physical acquisition, as it allows for a complete image of the device, including deleted files and unallocated space. A, Direct acquisition, and C, Logical acquisition, do not capture all the data on the device, while D, Manual acquisition, involves collecting data in a more hands-on manner, which is less comprehensive.