What does it mean if the hash of a forensic image matches the hash of the original evidence drive?

The image is corrupted and must be re-acquired

The image is an exact copy of the original drive

An examiner needs to acquire a USB flash drive from a suspect. The examiner's forensic workstation has a hardware write blocker available, but the USB drive is already connected directly to the workstation's USB port. The examiner wants to ensure the evidence is not modified. What is the most appropriate action?

Copy the files to a folder on the workstation and then hash the folder.

Use a software write blocker on the workstation and image the drive in place.

Image the drive without a write blocker because USB drives are read-only by default.

Disconnect the USB drive, connect it through the hardware write blocker, then image it.

A forensic examiner must acquire a SATA SSD from a seized laptop. The examiner connects the SSD to a write blocker and then to a forensic workstation. After imaging, the examiner computes a SHA-256 hash of the image file and compares it to the hash of the original device. Why is the write blocker essential in this process?

It converts the SATA interface to USB so the forensic workstation can recognize the SSD.

It prevents the operating system from mounting the SSD and altering file metadata during acquisition.

It ensures the hash of the image matches the hash of the original device.

It increases the speed of the imaging process by caching read operations.

An examiner is acquiring a drive that has been imaged before. The previous image's hash is known. The examiner wants to verify that the drive has not changed since the previous image was taken. What is the most reliable method?

Compute the current hash of the drive and compare it to the previous image's hash.

Check the drive's SMART attributes for changes in reallocated sectors.

Compare the drive's partition table to the previous image's partition table.

Compare the drive's file system timestamps to the previous image's timestamps.

An examiner is acquiring a drive that is suspected of containing data that was intentionally overwritten using a disk-wiping tool. The examiner wants to determine if any remnants of the original data exist. What is the most appropriate approach?

Image only the areas that were not overwritten, based on the wiping tool's log.

Skip the acquisition because the data is unrecoverable.

Perform a full bit-for-bit image and use forensic analysis techniques to look for remnants in slack space and unallocated areas.

Use a data recovery tool to restore the overwritten data before imaging.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 1

Dead Box Acquisition GBFA Practice Questions (Page 8)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 36–40

36foundation · easy
What does it mean if the hash of a forensic image matches the hash of the original evidence drive?
Select an answer first
37application · medium
An examiner needs to acquire a USB flash drive from a suspect. The examiner's forensic workstation has a hardware write blocker available, but the USB drive is already connected directly to the workstation's USB port. The examiner wants to ensure the evidence is not modified. What is the most appropriate action?
Select an answer first
38application · medium
A forensic examiner must acquire a SATA SSD from a seized laptop. The examiner connects the SSD to a write blocker and then to a forensic workstation. After imaging, the examiner computes a SHA-256 hash of the image file and compares it to the hash of the original device. Why is the write blocker essential in this process?
Select an answer first
39expert · hard
An examiner is acquiring a drive that has been imaged before. The previous image's hash is known. The examiner wants to verify that the drive has not changed since the previous image was taken. What is the most reliable method?
Select an answer first
40expert · hard
An examiner is acquiring a drive that is suspected of containing data that was intentionally overwritten using a disk-wiping tool. The examiner wants to determine if any remnants of the original data exist. What is the most appropriate approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Dead Box Acquisition GBFA Practice Questions (Page 8)

Questions 36–40

What does it mean if the hash of a forensic image matches the hash of the original evidence drive?

An examiner is acquiring a drive that has been imaged before. The previous image's hash is known. The examiner wants to verify that the drive has not changed since the previous image was taken. What is the most reliable method?

An examiner is acquiring a drive that is suspected of containing data that was intentionally overwritten using a disk-wiping tool. The examiner wants to determine if any remnants of the original data exist. What is the most appropriate approach?

Keep studying — Acquisition Techniques