A forensic examiner is acquiring a 2 TB drive with 512-byte sectors. The drive is connected to a write blocker and the examiner wants to verify that the acquisition is bit-for-bit accurate. Which method should be used?

Check that the image file opens in a forensic tool.

Verify the partition table on the image matches the source.

Compare the hash of the source drive to the hash of the acquired image using SHA-256.

Compare the file sizes of the source and the image.

A forensic team is preparing to acquire a 2 TB drive from a desktop computer that is powered off. They have a hardware write-blocker and a forensic workstation. Which acquisition method should they use to ensure the integrity of the evidence?

Copy the entire drive to a network share using the computer's operating system.

Remove the drive, connect it to the write-blocker, and create a bit-for-bit image on the forensic workstation.

Boot the computer from a forensic live CD and image the drive over the network.

Use a software write-blocker on the forensic workstation and connect the drive directly to it.

In the FAT file system, what does the File Allocation Table primarily track?

The chain of clusters that make up each file

The permissions and ownership of each file

The physical sector addresses of each file's data

The timestamps of file creation and modification

An analyst is investigating a case involving a suspect who deleted files from a USB drive formatted with exFAT. The files were deleted, and the drive has been used since then. What is the most likely reason the deleted files cannot be recovered?

The files were encrypted by the file system.

The file system does not support file recovery.

The clusters that contained the files have been overwritten by new data.

The files were moved to the recycle bin and then permanently deleted.

GIAC Battlefield Forensics and Acquisition

Domain 2Objective 3

Data on Drives GBFA Practice Questions (Page 5)

Part of the Filesystems and Data Storage domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

Questions 21–25

21application · medium
A forensic examiner is acquiring a 2 TB drive with 512-byte sectors. The drive is connected to a write blocker and the examiner wants to verify that the acquisition is bit-for-bit accurate. Which method should be used?
Select an answer first
22application · easy
A forensic team is preparing to acquire a 2 TB drive from a desktop computer that is powered off. They have a hardware write-blocker and a forensic workstation. Which acquisition method should they use to ensure the integrity of the evidence?
Select an answer first
23foundation · easy
In the FAT file system, what does the File Allocation Table primarily track?
Select an answer first
24foundation · easy
Which data acquisition method involves capturing data from a system while it is powered on and running?
Select an answer first
25application · medium
An analyst is investigating a case involving a suspect who deleted files from a USB drive formatted with exFAT. The files were deleted, and the drive has been used since then. What is the most likely reason the deleted files cannot be recovered?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.