Why is RAM collected before creating a forensic image of the hard drive?

RAM is easier to acquire than the hard drive.

RAM acquisition does not require any special tools.

The hard drive image is needed to interpret the RAM data.

RAM contains data that is more volatile and would be lost if the system is powered down.

A forensic responder is at a scene with a running Windows system that has an encrypted hard drive (BitLocker) and an active user session. The incident handler wants to preserve the ability to decrypt the drive later. Which action should the responder take FIRST?

Capture the RAM to obtain the BitLocker decryption keys from memory.

Power off the system immediately to prevent further writes to the encrypted drive.

Image the hard drive first using a hardware write-blocker.

Record the user's password as they type it into the system.

An incident responder is collecting evidence from a Windows system and needs to document which files were accessed by a specific user. Which combination of OS artifacts would provide the MOST direct evidence of user file access?

The C:\Windows\Prefetch folder and the system32\config\SAM hive.

The Windows Event Log and the pagefile.sys file.

NTFS $UsnJrnl and the user's NTUSER.DAT registry hive.

The Recycle Bin and the C:\Users\Public folder.

A forensic analyst is responding to a suspected rootkit infection on a Windows server. The analyst has a trusted memory acquisition tool on a USB drive, but suspects the rootkit may be hiding processes and memory regions from the operating system. The analyst needs to obtain a memory image that is as complete and trustworthy as possible. Which approach is MOST appropriate?

Run the trusted software tool from the USB drive and compare its output to a second software tool.

Boot the system from a trusted forensic Linux CD and use 'dd' to read /dev/mem.

Use the Windows 'crash dump' feature to force a memory dump.

Use a hardware-based memory acquisition device that reads physical memory directly via PCIe.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 4

Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 3)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 11–15

11foundation · easy
Which tool is commonly used to acquire a forensic image of a Windows Registry hive?
Select an answer first
12foundation · easy
Why is RAM collected before creating a forensic image of the hard drive?
Select an answer first
13application · medium
A forensic responder is at a scene with a running Windows system that has an encrypted hard drive (BitLocker) and an active user session. The incident handler wants to preserve the ability to decrypt the drive later. Which action should the responder take FIRST?
Select an answer first
14application · medium
An incident responder is collecting evidence from a Windows system and needs to document which files were accessed by a specific user. Which combination of OS artifacts would provide the MOST direct evidence of user file access?
Select an answer first
15expert · hard
A forensic analyst is responding to a suspected rootkit infection on a Windows server. The analyst has a trusted memory acquisition tool on a USB drive, but suspects the rootkit may be hiding processes and memory regions from the operating system. The analyst needs to obtain a memory image that is as complete and trustworthy as possible. Which approach is MOST appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 3)

Questions 11–15

Which tool is commonly used to acquire a forensic image of a Windows Registry hive?

Why is RAM collected before creating a forensic image of the hard drive?

A forensic responder is at a scene with a running Windows system that has an encrypted hard drive (BitLocker) and an active user session. The incident handler wants to preserve the ability to decrypt the drive later. Which action should the responder take FIRST?

An incident responder is collecting evidence from a Windows system and needs to document which files were accessed by a specific user. Which combination of OS artifacts would provide the MOST direct evidence of user file access?

Keep studying — Acquisition Techniques