Digital Forensic Certification Practice Exam

What type of data acquisition was performed when only ".ost" files were extracted from the victim system?

1. Logical acquisition

2. Physical acquisition

3. Network acquisition

4. Complete acquisition

The correct answer is: Logical acquisition

The situation described involves the extraction of only ".ost" files, which are Offline Storage Table files used by Microsoft Outlook to store emails, calendars, contacts, and other data. This specific extraction indicates that only specific data related to the emails was retrieved instead of duplicating the entire storage medium or disk. Logical acquisition refers to a method of data collection that focuses on specific files or data structures rather than a complete bit-by-bit copy of the entire physical storage. In this case, by targeting only the ".ost" files, the acquisition is limited to this logical subset of data, which aligns perfectly with the definition of logical acquisition. Given that physical acquisition would involve obtaining an entire image of the drive, capturing all data, including unallocated space and files not being used by the operating system, it is clear that the action performed does not match this method. Additionally, network acquisition pertains to capturing data that travels over a network, which does not apply in this scenario since the data was extracted directly from a file on the victim’s system. Complete acquisition similarly refers to capturing all data from the storage device, which is not the case here. Thus, the specified extraction of only ".ost" files exemplifies logical acquisition, where only a particular range