Host Based Live Acquisition GBFA Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   You are the lead examiner in a case where a live acquisition was performed by a junior analyst. The analyst used a tool from the suspect system and did not record the time of acquisition. What is the MOST significant consequence?

   • AThe evidence may be ruled inadmissible due to broken chain of custody.
   • BThe analyst will be fired immediately.
   • CThe evidence will be automatically deleted by the system.
   • DThe evidence will be corrupted and unusable.
   Reveal Solution Discussion Select an answer first
2. 47application · medium · select all that apply

   You are performing live acquisition on a compromised system. Which of the following are considered volatile data that should be collected during live acquisition? Select all that apply.

   • AFiles stored on the hard drive
   • BActive network connections
   • CRegistry hives
   • DRunning processes
   • EContents of physical memory
   Check answers Discussion Select an answer first
4. 48expert · hard

   A responder is performing a live acquisition on a database server that is critical to business operations. The server cannot be shut down, and the responder has only 15 minutes before the system must be returned to full operation. The responder must collect the most probative evidence within this time. Which collection plan is best?

   • ACapture memory, then copy the entire hard drive, then record network connections.
   • BRun a full system backup to tape, then capture memory.
   • CList all open files first, then processes, then network connections, and capture memory last.
   • DCapture memory, then record network connections, then list processes, and skip open files if time runs short.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A forensic examiner is on site and must acquire memory from a Windows 10 system. The examiner has a USB drive with several tools, but the system has a policy that blocks unsigned drivers. Which tool is most likely to work without requiring a driver installation?

   • AWinPmem, which uses a signed driver that is already whitelisted on most systems.
   • BThe built-in 'dumpbin' tool from the Windows SDK.
   • CA custom-built memory acquisition tool that requires an unsigned driver.
   • DFTK Imager's memory capture feature, which requires a driver that may be unsigned.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A forensic examiner is performing a live acquisition on a system that is part of an ongoing criminal investigation. The examiner must ensure that the evidence is admissible in court. Which practice is most critical to ensure admissibility?

   • AUse the most expensive forensic tool available.
   • BMaintain a detailed chain of custody log and use hashing to verify the integrity of all acquired data.
   • CEnsure the acquisition tool is the latest version, even if it is untested.
   • DPerform the acquisition as quickly as possible without documentation.
   Reveal Solution Discussion Select an answer first