Dead Box Acquisition GBFA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a dead box acquisition, the examiner notices that the hard drive's partition table appears to have been overwritten with random data. The drive still contains data in the unallocated space. What is the best course of action?

   • AOnly image the unallocated space to avoid capturing the corrupted partition table.
   • BStop the acquisition and return the drive to the suspect because the evidence is compromised.
   • CUse a data recovery tool to rebuild the partition table before imaging.
   • DImage the entire drive bit-for-bit, including the overwritten partition table, and document the anomaly.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of dead box acquisition in a forensic investigation?

   • ATo perform real-time monitoring of user activity on the target system
   • BTo collect volatile data such as running processes and network connections from a live system
   • CTo create a forensic image of a powered-off storage device without altering its contents
   • DTo analyze the system's RAM for encryption keys and passwords
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An examiner creates a forensic image of a drive and computes a hash of the image. Later, the examiner needs to verify that the image has not been altered during storage. What is the most appropriate method?

   • ACopy the image to a new drive and compare the copy to the original image.
   • BCheck the file size of the image to ensure it matches the original drive size.
   • COpen the image in a forensic tool and visually inspect the files.
   • DRecompute the hash of the stored image and compare it to the original hash recorded at acquisition time.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   During acquisition of a suspect's hard drive, the imaging tool reports that the source device has a capacity of 500 GB, but the image file is only 250 GB and the tool warns of 'unreadable sectors' at the end of the drive. The examiner suspects the drive may have been tampered with. What is the most appropriate next step?

   • AUse a software tool to force the drive to report its true capacity and then re-image the entire drive.
   • BDocument the warning, attempt to image the unreadable sectors with a hardware imager that supports bad-sector retries, and note the discrepancy in the report.
   • CAssume the drive was resized by the manufacturer and accept the 250 GB image as complete.
   • DStop the acquisition and return the drive to the suspect because the drive is damaged and cannot be imaged.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An examiner is acquiring a drive that is suspected to contain encrypted data. The examiner has a hardware write blocker and a forensic imaging tool. The examiner notices that the drive has a hidden partition that is encrypted. What is the most appropriate action?

   • ASkip the hidden partition because it is encrypted and cannot be read.
   • BImage the entire physical drive, including the hidden partition, and document that the partition is encrypted for later analysis.
   • CUse a software tool to remove the encryption and then image the drive.
   • DAttempt to decrypt the partition on the original drive before imaging.
   Reveal Solution Discussion Select an answer first