GIAC (SANS)GIAC Battlefield Forensics and Acquisition
The GIAC Battlefield Forensics and Acquisition (GBFA) certification validates a practitioner's readiness to handle every facet of the data collection and rapid triage process. It proves you can properly collect, acquire, and conduct rapid triage analysis across a wide range of data storage—from portable devices and servers to IoT and cloud. For federal agents, incident responders, and forensic analysts, GBFA demonstrates you can deliver indispensable data acquisition and analysis when it matters most, on the technical battlefield.
786 practice questions · Updated 2026-07-30
GBFA Curriculum
Every domain, objective, and concept the GBFA exam measures.
- Acquisition Preparation Overview
- Pre-Acquisition Planning
- Legal and Authorization Considerations
- Tool and Equipment Readiness
- Documentation and Chain of Custody
- Scene and Evidence Assessment
- Order of Volatility
- Contingency Planning
- Computer hardware components
- Operating system basics
- File systems and storage
- Data representation
- Computer networking fundamentals
- Physical Storage Device Types
- Storage Device Interfaces
- Data Storage Principles
- Device Identification and Documentation
- Storage media types
- Storage interfaces and connectors
- File system basics
- Data storage hierarchy
- Storage device acquisition considerations
- Filesystem Hierarchy
- Filesystem Types
- Data Storage Units
- Partitioning and Volume Management
- Metadata and Inodes
- File Allocation Methods
- Journaling and Logging
- Deleted File Recovery Basics
- NTFS Fundamentals
- FAT/exFAT Fundamentals
- Windows Filesystem Forensics
- Drive data representation
- File system structures
- Data acquisition methods
- Data recovery basics
- Dead Box Acquisition Overview
- Forensic Imaging Fundamentals
- Write Blockers
- Hardware vs. Software Write Blockers
- Imaging Tools and Techniques
- Verification and Hashing
- Chain of Custody
- Handling Anti-Forensics
- Host-Based Live Acquisition Overview
- Volatile Data Identification
- Acquisition Order of Volatility
- Live Acquisition Tools
- Memory Acquisition Techniques
- System State Capture
- Evidence Handling in Live Acquisition
- Challenges and Limitations
- Remote Acquisition Overview
- Legal and Authorization Considerations
- Network-Based Acquisition Methods
- Remote Forensic Tools
- Imaging Over the Network
- Handling Volatile Data Remotely
- Encryption and Secure Transmission
- Verification and Integrity Checks
- Troubleshooting Remote Acquisition
- RAM Acquisition Methods
- RAM Acquisition Tools
- Order of Volatility
- OS Artifact Categories
- Acquiring OS Artifacts
- Evidence Handling and Documentation
- Mobile Device Acquisition Overview
- Acquisition Methods
- Device Preparation and Isolation
- Forensic Imaging of Mobile Devices
- Data Extraction from Mobile Devices
- Handling Encrypted and Locked Devices
- Documentation and Chain of Custody
- Mobile Device Triage Overview
- Triage Process Steps
- Data Prioritization
- Triage Tools and Techniques
- Legal and Chain of Custody
- Specialty Device Identification
- Acquisition Methods for Specialty Devices
- Data Extraction Challenges
- Evidence Handling and Preservation
- Network Data Acquisition
- Network Evidence Handling
- Network Protocols and Data Structures
- Network Traffic Analysis
- Legal and Ethical Considerations
- Evidence File Types
- Evidence File Integrity
- Evidence File Handling Procedures
- Evidence File Documentation
- Evidence File Acquisition
- Evidence File Analysis
- Triage Fundamentals
- Evidence Prioritization
- Initial Assessment Techniques
- Artifact Identification
- Data Collection Strategy
- Documentation and Chain of Custody
- Manual Data Search Techniques
- File System Navigation
- Artifact Recognition
- Keyword and String Searching
- Data Carving Fundamentals
- Timeline Analysis
- Metadata Examination
- Correlating Findings
- Triage Tool Selection
- Triage Tool Operation
- Data Prioritization
- Triage Documentation
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GBFA, so none is invented.