Dead Box Acquisition GBFA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A forensic examiner needs to acquire a laptop with a built-in NVMe SSD. The examiner has a hardware write blocker that only supports SATA and a software write blocker that supports NVMe. What is the best course of action?

   • ABoot the laptop from a forensic live USB and image the NVMe SSD using the built-in tool.
   • BRemove the NVMe SSD and use a hardware write blocker that supports NVMe, or if unavailable, use a validated software write blocker on a trusted forensic workstation.
   • CImage the NVMe SSD without a write blocker because NVMe drives are read-only by default.
   • DConnect the NVMe SSD to the SATA write blocker using an adapter.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A forensic examiner is asked to acquire a computer that is part of an ongoing investigation. The computer is currently off. The examiner wants to perform a dead box acquisition. What is the first step the examiner should take?

   • ADocument the scene, including the computer's condition and any visible connections, before touching the device.
   • BTurn on the computer to check if it boots.
   • CRemove the hard drive immediately to begin imaging.
   • DAsk the owner for permission to acquire the drive.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary role of a write blocker in forensic acquisition?

   • ATo encrypt the evidence drive to protect it from unauthorized access
   • BTo speed up the imaging process by compressing data
   • CTo allow the investigator to write notes directly to the evidence drive
   • DTo prevent any write operations from reaching the evidence drive
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an example of an anti-forensic technique that could affect dead box acquisition?

   • AUsing a standard file system like NTFS
   • BEncrypting the hard drive
   • CHaving a large hard drive
   • DUsing a USB 3.0 connection
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic examiner must acquire a SATA SSD from a seized laptop. The examiner has a forensic workstation with a hardware write blocker that supports SATA and a software write blocker utility that claims to block writes at the operating system level. The examiner wants to ensure the highest evidentiary integrity and minimize the risk of accidental modification. Which approach is the most defensible?

   • AConnect the SSD through the hardware write blocker and image it with a forensic tool that computes a hash during acquisition.
   • BConnect the SSD directly to the workstation and use the software write blocker, then verify the image with a hash.
   • CRemove the SSD and use a USB-to-SATA adapter without a write blocker, then immediately hash the image.
   • DBoot the seized laptop from a forensic live CD and use the built-in imaging tool to create a logical copy of the files.
   Reveal Solution Discussion Select an answer first