Exam 312-49v10 topic 1 question 311 discussion

The correct answer is B. Sparse or Logical Acquisition. When acquiring data from RAID storage, a sparse or logical acquisition is recommended to retrieve only the data relevant to the investigation. This method captures only the logical files and folders, without duplicating redundant data or acquiring unused space on the RAID array. This approach helps to reduce the amount of data to be analyzed and minimizes the risk of data overload. Here's a brief overview of the other options: A. Static Acquisition: This method involves creating a bit-for-bit copy of the entire RAID array, including unused space and redundant data. C. Bit-stream disk-to-disk Acquisition: Similar to static acquisition, this method creates an exact replica of the entire RAID array, including unused space and redundant data. D. Bit-by-bit Acquisition: This method is similar to static acquisition, but is typically used for single disks, not RAID arrays.

B: A logical acquisition captures only specific files of interest to the case or specific types of files. A sparse acquisition is similar but also collects fragments of unallocated (deleted) data; use this method only when you don't need to examine the entire drive.