Data Acquisition in digital forensics primarily involves imaging or obtaining information from a device and its peripherals.

• A. Deleting data to protect privacy
• B. Only analyzing data
• C. Only network data
• D. Imaging or obtaining information from a device and its peripherals

Answer: (D)

Data acquisition in digital forensics is about collecting exact copies of the data from a device and any connected media to preserve evidence for later analysis. This involves imaging the primary storage and, when possible, capturing volatile data like RAM, along with data from peripherals such as USB drives, memory cards, and other attached devices. The goal is to create a forensically sound copy (often a bit-for-bit image) and to verify integrity with cryptographic hashes (like SHA-256) while documenting the process and maintaining chain of custody. Acquisition is the initial step that enables reliable examination later; it is not about deleting data, nor is it limited to analyzing data or only network data.