Question

which of the following are advantages of the raw format for static acquisitions? (choose all that apply.)
a. achieves faster data speeds
b. ignores minor data errors
c. can be read by most forensics tools
d. requires less storage space than the source drive
e. natively includes hash values of the raw file

Explanation:

• Raw format creates a bit-for-bit copy, which is widely supported by forensic tools as a standard acquisition format.
• It does not skip minor errors; it captures all data, including errors. It does not compress data, so it requires the same or more storage than the source drive, not less. It does not natively include hash values (hashes are generated separately). Faster speeds are not a trait; it is often slower due to full copying.

Answer:

c. Can be read by most forensics tools