The correct answer is D because sparse acquisition is specifically used when investigators collect only selected data that is relevant to the case rather than imaging the entire disk. In CHFI v11, the data acquisition objectives emphasize understanding different acquisition types and determining the most suitable method depending on the investigative need, time constraints, and storage considerations. A bitstream acquisition captures the whole media at the sector level, including slack space and deleted data, which is not what the question describes. Logical acquisition usually focuses on active files and folders visible through the file system, but the wording here highlights a deliberate case-focused subset chosen to reduce time and storage, which is the classic rationale for sparse acquisition. This method is useful when investigators must quickly preserve high-value evidence without creating a complete forensic image. In exam terms, whenever the scenario stresses targeted collection of specific files, folders, or fragments tied to the incident, while avoiding full disk capture, sparse acquisition is the best fit. That matches the CHFI objective on selecting appropriate acquisition methods for different evidence situations.