An examiner is responding to a live incident where a server is still running. The examiner needs to collect evidence in the correct order. Which of the following lists the evidence in the correct order of volatility, from most to least volatile?

Network connections, RAM, hard drive, temporary files.

RAM, network connections, temporary files, hard drive.

Hard drive, temporary files, network connections, RAM.

Temporary files, RAM, network connections, hard drive.

A forensic examiner is preparing to acquire evidence from a suspect's external hard drive. The examiner has a write blocker, a forensic imaging tool, and a clean USB drive for storing the image. Before starting the acquisition, what is the most critical step the examiner should take?

Connect the suspect's drive directly to the forensic workstation without a write blocker to save time.

Take a photograph of the suspect's drive before connecting it to any equipment.

Format the USB drive to ensure it has enough space for the image.

Verify that the write blocker is functioning correctly by testing it with a known non-evidentiary drive.

A forensic examiner is preparing to acquire evidence from a suspect's smartphone. The examiner has a forensic tool that is known to work with the smartphone model, but the tool has not been used in several months. What is the MOST appropriate action before starting the acquisition?

Test the forensic tool on a similar non-evidentiary smartphone to ensure it works correctly.

Document the tool's version and configuration in the case file.

Begin the acquisition immediately since the tool is known to work with the smartphone model.

Update the forensic tool to the latest version to ensure compatibility with the smartphone.

You are assessing a scene where a suspect's computer is running, and you notice a cloud storage sync client is active. The case involves data theft, and you suspect the suspect may have uploaded files to the cloud. What is the most important consideration for your acquisition strategy?

Disconnect the network immediately to prevent further cloud uploads

Capture memory and network connections to identify cloud storage endpoints and active sessions

Image the hard drive first to capture any locally cached cloud files

Contact the cloud provider to request the suspect's account data

Why is it important to assess the scene before starting the acquisition?

To decide whether to use a hardware or software write-blocker

To calculate the total cost of the investigation

To determine which devices are relevant and prioritize their collection

To determine the suspect's level of technical skill

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 1

Acquisition Preparation GBFA Practice Questions (Page 6)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

8concepts

Questions 26–30

26application · medium
An examiner is responding to a live incident where a server is still running. The examiner needs to collect evidence in the correct order. Which of the following lists the evidence in the correct order of volatility, from most to least volatile?
Select an answer first
27application · medium
A forensic examiner is preparing to acquire evidence from a suspect's external hard drive. The examiner has a write blocker, a forensic imaging tool, and a clean USB drive for storing the image. Before starting the acquisition, what is the most critical step the examiner should take?
Select an answer first
28application · medium
A forensic examiner is preparing to acquire evidence from a suspect's smartphone. The examiner has a forensic tool that is known to work with the smartphone model, but the tool has not been used in several months. What is the MOST appropriate action before starting the acquisition?
Select an answer first
29expert · hard
You are assessing a scene where a suspect's computer is running, and you notice a cloud storage sync client is active. The case involves data theft, and you suspect the suspect may have uploaded files to the cloud. What is the most important consideration for your acquisition strategy?
Select an answer first
30foundation · easy
Why is it important to assess the scene before starting the acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.