A forensic examiner must acquire a server that is running a critical database. The server has a 10 TB RAID 5 array. The examiner needs to preserve the database's live state and also acquire the underlying drives. The database is actively writing data. What is the best approach?

Perform a live acquisition of the logical volume only, without acquiring the physical drives.

Use a hardware RAID controller's snapshot feature to create a consistent snapshot, then acquire the snapshot and the physical drives.

Shut down the server immediately and acquire each physical drive in the RAID array.

Perform a live acquisition of the logical volume, then shut down the server and acquire each physical drive.

An analyst is trying to recover a deleted file from an NTFS volume. The MFT entry for the file has been reused by another file, but the analyst believes the original data is still in unallocated space. What technique is most likely to recover the data?

Use the $Bitmap to identify which clusters were previously allocated to the file.

Search for the file's signature in unallocated space using a carving tool.

Use the $LogFile to reconstruct the original MFT entry.

Restore the file from the Volume Shadow Copy if it was enabled.

A forensic examiner is documenting the structure of a drive that uses GUID Partition Table (GPT). The drive has a protective MBR at the beginning. What is the purpose of the protective MBR?

To store the file system metadata for the first partition.

To prevent legacy tools from misidentifying the drive as unpartitioned and attempting to overwrite it.

To provide a bootable partition for legacy BIOS systems.

To store the backup GPT header in case the primary header is corrupted.

An investigator is analyzing a drive formatted with NTFS and finds a file with multiple data streams. What is the most likely reason the file has multiple data streams?

The file was created on a system that uses alternate data streams for metadata.

The file was fragmented across the drive.

The file was encrypted by the file system.

The file was compressed by the file system.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 3

Data on Drives GBFA Practice Questions (Page 1)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

Questions 1–5

1expert · hard
A forensic examiner must acquire a server that is running a critical database. The server has a 10 TB RAID 5 array. The examiner needs to preserve the database's live state and also acquire the underlying drives. The database is actively writing data. What is the best approach?
Select an answer first
2expert · hard
An analyst is trying to recover a deleted file from an NTFS volume. The MFT entry for the file has been reused by another file, but the analyst believes the original data is still in unallocated space. What technique is most likely to recover the data?
Select an answer first
3application · medium
A forensic examiner is documenting the structure of a drive that uses GUID Partition Table (GPT). The drive has a protective MBR at the beginning. What is the purpose of the protective MBR?
Select an answer first
4application · medium
An investigator is analyzing a drive formatted with NTFS and finds a file with multiple data streams. What is the most likely reason the file has multiple data streams?
Select an answer first
5foundation · easy
Which file system uses a Master File Table (MFT) to store metadata about files and directories?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.