An examiner is acquiring a drive from a computer that is part of a corporate investigation. The examiner has a hardware write blocker that is known to be reliable. The examiner also has a software write blocker that has not been tested on the current operating system. Which write blocker should the examiner use?

The hardware write blocker, because it is reliable and does not depend on the operating system.

The software write blocker, because it is easier to set up.

The software write blocker, because it is faster than the hardware blocker.

Both write blockers together, to double the protection.

An examiner needs to acquire a 2 TB hard drive from a desktop computer. The examiner has a forensic imaging tool that supports creating E01 (EnCase) images. The examiner wants to verify the integrity of the image after acquisition. Which approach is most appropriate?

Create a logical image of only the user files to save time.

Create an E01 image and use the tool's built-in hash verification to compare the image's hash to the source drive's hash.

Create a raw (dd) image and rely on the file size to confirm completeness.

Use a software write blocker and then copy the drive's contents to a folder.

An examiner is acquiring a drive that is suspected to contain encrypted volumes. The examiner wants to ensure that the acquisition captures all data, including the encrypted volume's metadata. Which imaging technique is most appropriate?

Image only the unallocated space to avoid encrypted data.

Use a tool that decrypts the volume during acquisition.

Perform a full bit-for-bit image of the entire physical drive.

Perform a logical image of the visible partitions only.

An examiner is acquiring a drive that appears to have been subjected to an anti-forensic technique: the drive's firmware has been modified to report a smaller capacity than the physical size. The examiner suspects hidden data in the unreported area. What is the most appropriate action?

Image the drive normally and note that the capacity is smaller than expected.

Image the drive using a tool that can access the full physical capacity, bypassing the firmware's reported size.

Assume the drive is defective and document it as such.

Use a hardware write blocker and then use a data recovery tool to reset the firmware.

During acquisition, the examiner notices that the hard drive has a large number of bad sectors. The imaging tool reports read errors but continues. What should the examiner do?

Increase the read timeout to force the drive to read the bad sectors.

Allow the tool to continue and document the bad sectors in the acquisition report.

Stop the acquisition and use a data recovery tool to repair the bad sectors first.

Image only the good sectors and skip the bad ones to save time.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 1

Dead Box Acquisition GBFA Practice Questions (Page 6)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 26–30

26application · medium
An examiner is acquiring a drive from a computer that is part of a corporate investigation. The examiner has a hardware write blocker that is known to be reliable. The examiner also has a software write blocker that has not been tested on the current operating system. Which write blocker should the examiner use?
Select an answer first
27application · medium
An examiner needs to acquire a 2 TB hard drive from a desktop computer. The examiner has a forensic imaging tool that supports creating E01 (EnCase) images. The examiner wants to verify the integrity of the image after acquisition. Which approach is most appropriate?
Select an answer first
28application · medium
An examiner is acquiring a drive that is suspected to contain encrypted volumes. The examiner wants to ensure that the acquisition captures all data, including the encrypted volume's metadata. Which imaging technique is most appropriate?
Select an answer first
29expert · hard
An examiner is acquiring a drive that appears to have been subjected to an anti-forensic technique: the drive's firmware has been modified to report a smaller capacity than the physical size. The examiner suspects hidden data in the unreported area. What is the most appropriate action?
Select an answer first
30application · medium
During acquisition, the examiner notices that the hard drive has a large number of bad sectors. The imaging tool reports read errors but continues. What should the examiner do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.