During a memory acquisition, your tool crashes and the system becomes unresponsive. You have a second memory acquisition tool available. What is the best course of action?

Attempt to use the second tool to capture memory

Reboot the system and try again

Document the failure and end the acquisition

Power off the system and image the hard drive

You are documenting the chain of custody for a seized laptop. You have recorded the date, time, and location of seizure. What additional information is most critical to record next?

The name and signature of the person who took custody

The serial number of the laptop

The make and model of the laptop

A forensic examiner is asked to acquire evidence from a company's file server as part of a civil litigation. The legal team has provided a list of specific files and folders to be collected. What is the MOST important step in pre-acquisition planning?

Acquire the entire server to avoid missing any evidence.

Ask the legal team to provide a new list of files after the acquisition.

Begin the acquisition immediately to preserve evidence before it is deleted.

Define the scope of the acquisition based on the legal request and document it.

Which activity is part of the acquisition preparation phase in a digital forensic investigation?

Recovering deleted files from the suspect's hard drive

Verifying that the write-blocker is functioning correctly

Creating a timeline of events from the acquired data

Interviewing witnesses about the incident

During scene assessment, what should an investigator identify first?

The legal jurisdiction of the scene

All potential sources of digital evidence

The type of write-blocker to use

The hash algorithm for the acquisition

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 1

Acquisition Preparation GBFA Practice Questions (Page 4)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 16–20

16application · medium
During a memory acquisition, your tool crashes and the system becomes unresponsive. You have a second memory acquisition tool available. What is the best course of action?
Select an answer first
17application · medium
You are documenting the chain of custody for a seized laptop. You have recorded the date, time, and location of seizure. What additional information is most critical to record next?
Select an answer first
18application · medium
A forensic examiner is asked to acquire evidence from a company's file server as part of a civil litigation. The legal team has provided a list of specific files and folders to be collected. What is the MOST important step in pre-acquisition planning?
Select an answer first
19foundation · easy
Which activity is part of the acquisition preparation phase in a digital forensic investigation?
Select an answer first
20foundation · easy
During scene assessment, what should an investigator identify first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.