An examiner acquires a drive and creates an image. The examiner then stores the image on an external drive and locks it in a evidence cabinet. What is the most important documentation to maintain for chain of custody?

A note describing the contents of the image.

A receipt from the purchase of the external drive.

A log that records who accessed the evidence cabinet and when, along with the image's hash value.

A forensic examiner is acquiring evidence from a server that is part of an ongoing investigation. The examiner must ensure that the evidence is admissible in court. The examiner has completed the acquisition and hashes. What additional step is most important for admissibility?

Use the most expensive imaging tool available.

Keep the original drive in a secure location without documenting access.

Document the entire chain of custody, including who handled the evidence and when.

Ensure the imaging tool is the latest version.

A forensic examiner is acquiring evidence from a company-owned laptop. The examiner must document every person who handled the laptop and the image. Which of the following is the primary purpose of this documentation?

To ensure the hash values are correct.

To demonstrate that the evidence was under continuous control and not tampered with.

To satisfy the company's IT policy.

To prove that the imaging tool was used correctly.

A forensic examiner is acquiring a drive from a suspect who claims the drive was already connected to a forensic workstation and may have been modified. The examiner must determine whether the drive was modified before acquisition. What is the best way to assess this?

Check the drive's SMART attributes for power-on hours and reallocated sectors.

Ask the suspect if the drive was modified.

Image the drive and compare it to a known-good image of the same model.

Compare the drive's current hash to a hash that was recorded at the time of seizure, if available.

When is a hardware write blocker generally preferred over a software write blocker?

When the acquisition must be performed remotely

When the evidence drive is smaller than 1 TB

When the forensic workstation's operating system is not fully trusted

When the evidence drive uses a non-standard file system

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 1

Dead Box Acquisition GBFA Practice Questions (Page 2)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 6–10

6application · medium
An examiner acquires a drive and creates an image. The examiner then stores the image on an external drive and locks it in a evidence cabinet. What is the most important documentation to maintain for chain of custody?
Select an answer first
7expert · hard
A forensic examiner is acquiring evidence from a server that is part of an ongoing investigation. The examiner must ensure that the evidence is admissible in court. The examiner has completed the acquisition and hashes. What additional step is most important for admissibility?
Select an answer first
8application · medium
A forensic examiner is acquiring evidence from a company-owned laptop. The examiner must document every person who handled the laptop and the image. Which of the following is the primary purpose of this documentation?
Select an answer first
9expert · hard
A forensic examiner is acquiring a drive from a suspect who claims the drive was already connected to a forensic workstation and may have been modified. The examiner must determine whether the drive was modified before acquisition. What is the best way to assess this?
Select an answer first
10foundation · easy
When is a hardware write blocker generally preferred over a software write blocker?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.