Dead Box Acquisition GBFA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How are hash values used to verify the integrity of a forensic image?

   • ABy comparing the hash of the original drive to the hash of the image
   • BBy encrypting the image with the hash value
   • CBy using the hash to compress the image file
   • DBy storing the hash in the image's metadata
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A forensic examiner is called to a scene where a computer is found powered on with a document open. The examiner needs to preserve evidence. What is the most appropriate action to take for a dead box acquisition?

   • AUse the operating system's shutdown option to gracefully turn off the computer.
   • BCopy the open document to a USB drive and then shut down the computer.
   • CPhotograph the screen, then pull the power cord from the back of the computer to perform a hard shutdown, and then remove the drive for imaging.
   • DUnplug the monitor and keyboard, then immediately remove the drive without shutting down.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which tool is commonly used for forensic imaging in dead box acquisition?

   • AFTK Imager
   • BNmap
   • CMetasploit
   • DWireshark
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Why is it important to create a forensic image rather than simply copying files?

   • AA file copy is sufficient for legal proceedings
   • BA forensic image preserves the exact state of the entire device, including hidden data
   • CA file copy is faster and more reliable for evidence
   • DA forensic image is smaller and easier to store
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A forensic examiner is on a tight budget and needs to acquire a SATA drive. The examiner has a forensic workstation with a software write blocker tool that intercepts write commands at the driver level. The examiner also has a hardware write blocker available. Which option is the most defensible for evidence integrity?

   • AUse the hardware write blocker because it provides a physical barrier against writes.
   • BUse no write blocker because the drive is write-protected by a jumper.
   • CUse the software write blocker because it is free and easier to set up.
   • DUse both the hardware and software write blockers simultaneously to double the protection.
   Reveal Solution Discussion Select an answer first