You are on-site at a crime scene and need to perform live acquisition on a Windows laptop that is running. You have a forensic USB drive with trusted tools, but the laptop has a USB-C port only. You have a USB-C to USB-A adapter. What is the BEST way to proceed?

Use the adapter to connect the USB drive and run the trusted tools from it.

Use built-in Windows tools to capture memory and save to the internal drive.

Disassemble the laptop to remove the hard drive and image it offline.

Ask the suspect to log in and run the tools for you.

What is the primary purpose of host-based live acquisition in digital forensics?

To preserve volatile data from a running system that would be lost when the system is powered off

To install forensic tools on a system so that it can be analyzed later in a lab

To securely erase all data on a compromised system to prevent further damage

To create a bit-for-bit copy of the entire hard drive without altering the original

A responder is collecting evidence from a live Windows system that is running a critical application. The responder must capture system state without disrupting the application. Which set of commands is least likely to disrupt the application while still capturing necessary volatile data?

Use a memory dump tool that requires stopping the application.

Use built-in commands like tasklist, netstat, and openfiles to capture process, network, and file information.

Reboot the system into safe mode and then collect the data.

Use third-party tools that install kernel drivers to capture the same information.

Why is it important to follow the order of volatility during live acquisition?

To prioritize the collection of data that is most likely to be lost or changed

To prevent the system from crashing during acquisition

To ensure that all data is collected in the shortest possible time

To avoid the need to document the acquisition process

What is the primary purpose of hashing the acquired data during live acquisition?

To verify the integrity of the acquired data

To encrypt the data to protect it from unauthorized access

To compress the data to save storage space

To label the data with a timestamp

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 2

Host Based Live Acquisition GBFA Practice Questions (Page 4)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 16–20

16expert · hard
You are on-site at a crime scene and need to perform live acquisition on a Windows laptop that is running. You have a forensic USB drive with trusted tools, but the laptop has a USB-C port only. You have a USB-C to USB-A adapter. What is the BEST way to proceed?
Select an answer first
17foundation · easy
What is the primary purpose of host-based live acquisition in digital forensics?
Select an answer first
18expert · hard
A responder is collecting evidence from a live Windows system that is running a critical application. The responder must capture system state without disrupting the application. Which set of commands is least likely to disrupt the application while still capturing necessary volatile data?
Select an answer first
19foundation · easy
Why is it important to follow the order of volatility during live acquisition?
Select an answer first
20foundation · easy
What is the primary purpose of hashing the acquired data during live acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.