During a RAM acquisition, the forensic tool generates a hash value of the memory image. The investigator records this hash in the case notes. Later, the defense attorney challenges the integrity of the evidence. What is the PRIMARY purpose of recording this hash value?

To encrypt the memory image so that only authorized personnel can view it.

To identify the specific make and model of the RAM modules in the system.

To compress the memory image so that it takes up less storage space.

To prove that the memory image has not been altered since the time of acquisition.

During a forensic acquisition of a compromised Linux server, the analyst must collect OS artifacts that will show which user accounts were created or modified around the time of the incident. Which set of artifacts is MOST appropriate for this specific investigative question?

The /var/spool/cron/crontabs directory for scheduled tasks.

The /var/log/auth.log and /var/log/syslog files.

The /etc/passwd and /etc/shadow files along with their file system timestamps.

The /home directory listing and user home folder contents.

A forensic analyst has just completed a RAM acquisition from a compromised server. The analyst notices that the memory image file is larger than the physical RAM installed in the system. What is the MOST LIKELY explanation for this?

The analyst accidentally captured the hard drive instead of RAM.

The tool compressed the data, and the compressed file is larger than the original.

The system had more RAM than reported by the operating system.

The acquisition tool included the pagefile or swap space in the image.

A forensic examiner is investigating a Windows system where the user is suspected of using a USB drive to exfiltrate data. The examiner needs to determine which USB devices were connected and when. The system is running and the examiner has administrative access. Which set of OS artifacts would provide the MOST comprehensive evidence of USB device usage?

The pagefile.sys and the hiberfil.sys files.

The SYSTEM registry hive (Setupapi.log or Setupapi.dev.log) and the Windows Event Log (Microsoft-Windows-DriverFrameworks-UserMode/Operational).

The NTUSER.DAT registry hive and the Prefetch folder.

The C:\Windows\System32\config\SAM hive and the Security Event Log.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 4

Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 4)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 16–20

16foundation · easy
Which OS artifact category includes the NTFS Master File Table (MFT)?
Select an answer first
17application · medium
During a RAM acquisition, the forensic tool generates a hash value of the memory image. The investigator records this hash in the case notes. Later, the defense attorney challenges the integrity of the evidence. What is the PRIMARY purpose of recording this hash value?
Select an answer first
18application · medium
During a forensic acquisition of a compromised Linux server, the analyst must collect OS artifacts that will show which user accounts were created or modified around the time of the incident. Which set of artifacts is MOST appropriate for this specific investigative question?
Select an answer first
19expert · hard
A forensic analyst has just completed a RAM acquisition from a compromised server. The analyst notices that the memory image file is larger than the physical RAM installed in the system. What is the MOST LIKELY explanation for this?
Select an answer first
20expert · hard
A forensic examiner is investigating a Windows system where the user is suspected of using a USB drive to exfiltrate data. The examiner needs to determine which USB devices were connected and when. The system is running and the examiner has administrative access. Which set of OS artifacts would provide the MOST comprehensive evidence of USB device usage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 4)

Questions 16–20

Which OS artifact category includes the NTFS Master File Table (MFT)?

During a RAM acquisition, the forensic tool generates a hash value of the memory image. The investigator records this hash in the case notes. Later, the defense attorney challenges the integrity of the evidence. What is the PRIMARY purpose of recording this hash value?

During a forensic acquisition of a compromised Linux server, the analyst must collect OS artifacts that will show which user accounts were created or modified around the time of the incident. Which set of artifacts is MOST appropriate for this specific investigative question?

A forensic analyst has just completed a RAM acquisition from a compromised server. The analyst notices that the memory image file is larger than the physical RAM installed in the system. What is the MOST LIKELY explanation for this?

Keep studying — Acquisition Techniques