An examiner has created a forensic image of a drive and recorded the SHA-256 hash. Later, the examiner needs to verify that the image has not been altered. Which action is most appropriate?

Recompute the SHA-256 hash of the image and compare it to the recorded hash.

Compare the image file size to the original drive's capacity.

Open the image in a viewer and look for obvious changes.

Check the image file's creation date and time.

Why is maintaining a chain of custody important during dead box acquisition?

To ensure the forensic image is compressed

To prove that the evidence was not tampered with from the moment of seizure to presentation in court

To speed up the acquisition process

To allow multiple investigators to work on the same evidence simultaneously

An examiner acquires a hard drive and creates a forensic image. The examiner then needs to transport the image to a lab for analysis. What is the most important step to maintain chain of custody?

Keep the image on the examiner's personal laptop and bring it to the lab without any documentation.

Encrypt the image file and send it via email to the lab.

Document the transfer of the image to the lab, including date, time, and the person receiving it, and obtain a signature.

Place the image on a shared network drive and notify the lab by phone.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 1

Dead Box Acquisition GBFA Practice Questions (Page 9)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 41–43

41application · medium
An examiner has created a forensic image of a drive and recorded the SHA-256 hash. Later, the examiner needs to verify that the image has not been altered. Which action is most appropriate?
Select an answer first
42foundation · easy
Why is maintaining a chain of custody important during dead box acquisition?
Select an answer first
43application · medium
An examiner acquires a hard drive and creates a forensic image. The examiner then needs to transport the image to a lab for analysis. What is the most important step to maintain chain of custody?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Dead Box Acquisition GBFA Practice Questions (Page 9)

Questions 41–43

An examiner has created a forensic image of a drive and recorded the SHA-256 hash. Later, the examiner needs to verify that the image has not been altered. Which action is most appropriate?

Why is maintaining a chain of custody important during dead box acquisition?

An examiner acquires a hard drive and creates a forensic image. The examiner then needs to transport the image to a lab for analysis. What is the most important step to maintain chain of custody?

Keep studying — Acquisition Techniques