Question

which files are collected during a logical acquisition?
a. files that are of interest to the case
b. all files on the storage device
c. all files and deleted data on the storage device
d. all data, including intentionally hidden data not recorded by the master file table, on the entire storage medium

Explanation:

Logical acquisition focuses on targeted data relevant to an investigation, rather than capturing the entire storage device (which is a physical acquisition). Options b, c, and d describe physical acquisition or more comprehensive data captures, while logical acquisition only retrieves files pertinent to the case.

Answer:

a. Files that are of interest to the case