Data Acquisition is the process of imaging or otherwise obtaining information from a digital device and its peripheral equipment and media. Which statement is true?

• A. True
• B. False
• C. It is only imaging, not data retrieval
• D. Only applies to media, not devices

Answer: (A)

Data acquisition in digital forensics means capturing or copying information from a device and any connected peripherals and storage media in a way that preserves its integrity for later analysis. This includes imaging (a bit-for-bit copy) as well as other methods of obtaining data, and it covers both the device itself and its peripherals and media, not just one part of the system. The statement aligns with this scope, so it is true. In practice, investigators may also gather volatile data from memory and non-volatile data from drives and removable media, all while maintaining chain of custody and using precautions like write blockers to prevent altering evidence.