An incident responder must acquire the physical memory of a Windows 10 workstation that is currently running and cannot be shut down. The responder has a write-blocked forensic USB drive and needs to minimize the footprint on the target. Which tool and method is most appropriate?

Run WinPmem from the forensic USB drive and write the memory image directly to the same USB drive.

Run dd from the forensic USB drive to read \Device\PhysicalMemory and write the image to the local hard drive.

Use FTK Imager to create a logical image of the C: drive, then later extract memory from the image.

Use the built-in Task Manager to create a dump of the System process and save it to the USB drive.

A forensic examiner is attempting to acquire memory from a Linux system that has kernel modules loaded that may be malicious. The examiner is concerned that the acquisition tool itself may be tampered with. Which approach best addresses this concern?

Use a network-based memory acquisition tool that sends the image to a remote server.

Use the system's built-in /proc/kcore to copy memory.

Boot the system from a trusted forensic live CD and then acquire memory using a tool from that trusted environment.

Run the acquisition tool from the suspect system's hard drive.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 2

Host Based Live Acquisition GBFA Practice Questions (Page 11)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 51–52

51application · medium
An incident responder must acquire the physical memory of a Windows 10 workstation that is currently running and cannot be shut down. The responder has a write-blocked forensic USB drive and needs to minimize the footprint on the target. Which tool and method is most appropriate?
Select an answer first
52expert · hard
A forensic examiner is attempting to acquire memory from a Linux system that has kernel modules loaded that may be malicious. The examiner is concerned that the acquisition tool itself may be tampered with. Which approach best addresses this concern?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Host Based Live Acquisition GBFA Practice Questions (Page 11)

Questions 51–52

An incident responder must acquire the physical memory of a Windows 10 workstation that is currently running and cannot be shut down. The responder has a write-blocked forensic USB drive and needs to minimize the footprint on the target. Which tool and method is most appropriate?

A forensic examiner is attempting to acquire memory from a Linux system that has kernel modules loaded that may be malicious. The examiner is concerned that the acquisition tool itself may be tampered with. Which approach best addresses this concern?

Keep studying — Acquisition Techniques