You need to acquire the Windows registry hives from a live system without altering the evidence. Which tool and method is most appropriate?

Copy the hive files from C:\Windows\System32\config using Windows Explorer.

Boot from a live Linux USB and copy the hive files directly.

Use reg.exe to export each hive to a network share.

Use a forensic tool like FTK Imager to copy the hive files while the system is running.

During a RAM acquisition, the responder calculates a SHA-256 hash of the memory image on the acquisition machine. Why is this hash important for the investigation?

It proves the image was captured from the correct machine.

It ensures the image contains no malware.

It allows the image to be compressed for storage.

It verifies the integrity of the image from the point of hashing onward.

A forensic responder needs to acquire memory from a system that is running a critical application. The responder has a software tool that requires the system to be rebooted into a special mode. The incident handler wants to minimize downtime. Which approach is MOST appropriate?

Use a software tool that can acquire memory from the running system without a reboot.

Reboot the system into the special mode and acquire memory.

Power off the system and remove the RAM modules for analysis.

Wait for the application to finish and then acquire memory.

During a forensic response, you must collect evidence from a running Windows system. Which sequence best follows the order of volatility?

Image the hard drive first, then capture RAM, then record network connections.

Copy the pagefile, then RAM, then the event logs.

Collect the registry hives, then RAM, then network connections.

Capture RAM, then network connections, then temporary files, then the registry hives.

What is the primary purpose of hashing an OS artifact immediately after acquisition?

To encrypt the data to protect it from unauthorized access

To compress the data for easier storage

To index the data for faster searching

To verify the integrity of the acquired data

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 4

Acquiring RAM and OS Artifacts GBFA Practice Questions (Page 9)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

6concepts

Questions 41–45

41application · medium
You need to acquire the Windows registry hives from a live system without altering the evidence. Which tool and method is most appropriate?
Select an answer first
42application · medium
During a RAM acquisition, the responder calculates a SHA-256 hash of the memory image on the acquisition machine. Why is this hash important for the investigation?
Select an answer first
43application · medium
A forensic responder needs to acquire memory from a system that is running a critical application. The responder has a software tool that requires the system to be rebooted into a special mode. The incident handler wants to minimize downtime. Which approach is MOST appropriate?
Select an answer first
44application · medium
During a forensic response, you must collect evidence from a running Windows system. Which sequence best follows the order of volatility?
Select an answer first
45foundation · easy
What is the primary purpose of hashing an OS artifact immediately after acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.