An examiner arrives at a scene where a computer is running, a smartphone is on the desk, and an external hard drive is connected to the computer. The examiner must prioritize the acquisition of evidence. Which of the following should be collected FIRST?

The contents of the computer's RAM.

The smartphone's internal storage.

You are a forensic examiner working with a multinational company. The company has offices in two countries with different data protection laws. You are asked to acquire data from a laptop that was used by an employee who worked in both countries. The laptop is currently in Country A, but the data may include personal data of citizens from Country B. What is the most important consideration before proceeding?

Determine which country's laws apply to the data and whether cross-border transfer is permitted

Proceed because the company owns the laptop

Ask the employee for consent to acquire all data

Acquire only the data related to Country A operations

During pre-acquisition planning, why is it important to define the scope of the acquisition?

To ensure the acquisition tool is compatible with the operating system

To determine which evidence sources are relevant and avoid collecting unnecessary data

To estimate the storage capacity needed for the forensic image

To decide whether to use a hardware or software write-blocker

What must an investigator obtain before performing a forensic acquisition of a suspect's personal computer?

An order from the company's IT department

A signed consent form or a valid search warrant

A certification in digital forensics

A written request from the victim

You are assessing a scene where a desktop computer is running, a printer is on, and a smartphone is on the desk. The case involves intellectual property theft. Which of the following is a potential evidence source that is often overlooked?

The printer's memory or spooler files

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 1

Acquisition Preparation GBFA Practice Questions (Page 5)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 21–25

21application · medium
An examiner arrives at a scene where a computer is running, a smartphone is on the desk, and an external hard drive is connected to the computer. The examiner must prioritize the acquisition of evidence. Which of the following should be collected FIRST?
Select an answer first
22expert · hard
You are a forensic examiner working with a multinational company. The company has offices in two countries with different data protection laws. You are asked to acquire data from a laptop that was used by an employee who worked in both countries. The laptop is currently in Country A, but the data may include personal data of citizens from Country B. What is the most important consideration before proceeding?
Select an answer first
23foundation · easy
During pre-acquisition planning, why is it important to define the scope of the acquisition?
Select an answer first
24foundation · easy
What must an investigator obtain before performing a forensic acquisition of a suspect's personal computer?
Select an answer first
25application · medium
You are assessing a scene where a desktop computer is running, a printer is on, and a smartphone is on the desk. The case involves intellectual property theft. Which of the following is a potential evidence source that is often overlooked?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.