A forensic team is preparing to acquire memory from a server that has hardware write-blockers available but no network access. The server has 128 GB of RAM and the team has a forensic workstation with a hardware write-blocker. Which acquisition method is MOST appropriate for this environment?

Use the Windows 'crash dump' feature to create a memory dump file on the local disk.

Use a remote acquisition tool over the network to dump memory to the forensic workstation.

Use a hardware-based memory acquisition device that connects to the PCIe or FireWire port.

Boot the system from a forensic Linux CD and use the 'dd' command to read /dev/mem.

According to the order of volatility, which of the following should be collected FIRST?

Network connections and routing tables

Data stored on external USB drives

A forensic team is acquiring evidence from a compromised server. Which action is most important for maintaining the admissibility of the evidence?

Analyzing the evidence on the original system.

Making multiple copies of the evidence and distributing them.

Using the fastest available acquisition tool.

Documenting every step of the acquisition and preserving the original evidence.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 4

Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 5)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 21–25

21application · medium
A forensic team is preparing to acquire memory from a server that has hardware write-blockers available but no network access. The server has 128 GB of RAM and the team has a forensic workstation with a hardware write-blocker. Which acquisition method is MOST appropriate for this environment?
Select an answer first
22foundation · easy
According to the order of volatility, which of the following should be collected FIRST?
Select an answer first
23foundation · easy
Which of the following is an example of an operating system artifact that is a system log?
Select an answer first
24application · medium
A forensic team is acquiring evidence from a compromised server. Which action is most important for maintaining the admissibility of the evidence?
Select an answer first
25foundation · easy
Which tool is specifically designed for capturing physical memory on Linux systems?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 5)

Questions 21–25

A forensic team is preparing to acquire memory from a server that has hardware write-blockers available but no network access. The server has 128 GB of RAM and the team has a forensic workstation with a hardware write-blocker. Which acquisition method is MOST appropriate for this environment?

According to the order of volatility, which of the following should be collected FIRST?

Which of the following is an example of an operating system artifact that is a system log?

A forensic team is acquiring evidence from a compromised server. Which action is most important for maintaining the admissibility of the evidence?

Which tool is specifically designed for capturing physical memory on Linux systems?

Keep studying — Acquisition Techniques