How can an investigator address the anti-forensic technique of disk encryption during dead box acquisition?

By imaging the drive and then attempting to crack the encryption

By reformatting the drive to remove the encryption

By booting the system to access the encrypted data

By using a stronger write blocker

During acquisition, the imaging tool encounters a large number of bad sectors on the drive. The examiner suspects the drive may have been physically damaged or intentionally corrupted. What is the best approach to maximize data recovery while maintaining forensic integrity?

Abandon the acquisition and request a new drive from the suspect.

Use a hardware imager that supports bad-sector retries and create a full physical image, documenting all errors.

Use a software tool to repair the bad sectors and then image the drive.

Skip the bad sectors and image only the readable portions to save time.

What information should be recorded in a chain of custody log?

The IP address of the forensic workstation

The brand and model of the forensic imaging tool used

The date, time, and signature of every person who handled the evidence

The hash values of the evidence drive

An examiner is about to acquire a drive that is connected to a forensic workstation via a USB dock. The examiner is concerned that the OS might automatically mount the drive and write to it. What is the most effective way to prevent this?

Use a software write blocker that filters write commands at the OS level.

Use a hardware write blocker between the USB dock and the workstation.

Connect the drive directly to the workstation's internal SATA port without a write blocker.

Disable the auto-mount feature in the OS settings.

A forensic examiner is acquiring a hard drive from a corporate server. The examiner documents the date, time, location, and the names of everyone who handled the drive. After imaging, the examiner records the hash value of the image. Why is this documentation critical?

It ensures that the hash value will match the original drive.

It establishes a chain of custody that shows who had access to the evidence and that it was not tampered with.

It proves that the imaging tool used was properly licensed.

It is required by the imaging software to create a valid image.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 1

Dead Box Acquisition GBFA Practice Questions (Page 4)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 16–20

16foundation · easy
How can an investigator address the anti-forensic technique of disk encryption during dead box acquisition?
Select an answer first
17expert · hard
During acquisition, the imaging tool encounters a large number of bad sectors on the drive. The examiner suspects the drive may have been physically damaged or intentionally corrupted. What is the best approach to maximize data recovery while maintaining forensic integrity?
Select an answer first
18foundation · easy
What information should be recorded in a chain of custody log?
Select an answer first
19application · medium
An examiner is about to acquire a drive that is connected to a forensic workstation via a USB dock. The examiner is concerned that the OS might automatically mount the drive and write to it. What is the most effective way to prevent this?
Select an answer first
20application · medium
A forensic examiner is acquiring a hard drive from a corporate server. The examiner documents the date, time, location, and the names of everyone who handled the drive. After imaging, the examiner records the hash value of the image. Why is this documentation critical?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.