An examiner is acquiring a laptop with a 512 GB NVMe SSD. The examiner connects the SSD to a hardware write blocker and images it to a forensic image file. After imaging, the examiner verifies the hash. What does the hash verification actually prove?

The SSD contains no hidden or encrypted data.

The SSD was not modified during the acquisition.

The examiner used the correct write blocker.

The image file is a bit-for-bit copy of the SSD at the time of acquisition.

An examiner is acquiring a drive that appears to have a hidden partition. The drive is recognized by the forensic tool, but the partition table shows only a small portion of the drive. The examiner suspects the drive has been manipulated to hide data. What is the most effective technique to recover the hidden data?

Perform a full physical acquisition of the entire drive, including unallocated space, and then analyze the image for hidden partitions or data remnants.

Use a software tool to wipe the drive and then image it to ensure no hidden data remains.

Use a partition recovery tool to restore the original partition table and then image only the restored partition.

Image only the visible partition and ignore the rest of the drive because it is likely empty.

An examiner needs to acquire a drive that is larger than the available storage on the forensic workstation. The examiner must preserve the evidence but has limited time and storage. Which approach is most appropriate?

Image only the allocated files to save space.

Use a forensic imaging tool that supports compressed image formats, such as E01, to reduce the storage footprint.

Use a hardware write blocker and then split the image into multiple smaller files.

Skip the acquisition and rely on the original drive as evidence.

During dead box acquisition, why is it necessary to use a write blocker?

To increase the speed of the acquisition process

To ensure the evidence drive is bootable for analysis

To prevent the operating system from mounting the evidence drive and altering it

To compress the data on the evidence drive for easier storage

What does a bit-for-bit forensic image capture?

Only the active files and folders on the storage device

The operating system files and system registry

The file system metadata and directory structure only

Every bit of the storage device, including unallocated space and file slack

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 1

Dead Box Acquisition GBFA Practice Questions (Page 7)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 31–35

31application · medium
An examiner is acquiring a laptop with a 512 GB NVMe SSD. The examiner connects the SSD to a hardware write blocker and images it to a forensic image file. After imaging, the examiner verifies the hash. What does the hash verification actually prove?
Select an answer first
32expert · hard
An examiner is acquiring a drive that appears to have a hidden partition. The drive is recognized by the forensic tool, but the partition table shows only a small portion of the drive. The examiner suspects the drive has been manipulated to hide data. What is the most effective technique to recover the hidden data?
Select an answer first
33expert · hard
An examiner needs to acquire a drive that is larger than the available storage on the forensic workstation. The examiner must preserve the evidence but has limited time and storage. Which approach is most appropriate?
Select an answer first
34foundation · easy
During dead box acquisition, why is it necessary to use a write blocker?
Select an answer first
35foundation · easy
What does a bit-for-bit forensic image capture?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.