Which data type is NOT considered volatile and therefore does NOT need to be collected during live acquisition?

The files stored on the hard drive

Which of the following is a key piece of system state information that should be captured during live acquisition?

The contents of the recycle bin

You need to acquire memory from a Windows server that is running a critical production workload. The server has 128 GB RAM and you have a forensic workstation with 256 GB free disk space. The server is in a remote data center and you have VPN access. What is the BEST method to acquire the memory?

Copy the memory image to the server's local disk and then transfer it later.

Run a trusted memory acquisition tool on the server and stream the image over the VPN to the forensic workstation.

Power off the server and remove the hard drives for imaging.

Use a remote desktop tool to run the acquisition and save the image to a network share.

A forensic examiner is documenting a live acquisition. The examiner has recorded the date, time, and the tool used. What additional information is required to complete the chain of custody documentation?

The version of the operating system on the suspect machine.

The name of every person who handled the evidence and the hash values of the acquired data.

The serial number of the suspect's computer.

The IP address of the forensic workstation.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 2

Host Based Live Acquisition GBFA Practice Questions (Page 6)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 26–30

26foundation · easy
Which data type is NOT considered volatile and therefore does NOT need to be collected during live acquisition?
Select an answer first
27foundation · easy
Which of the following is a key piece of system state information that should be captured during live acquisition?
Select an answer first
28expert · hard
You need to acquire memory from a Windows server that is running a critical production workload. The server has 128 GB RAM and you have a forensic workstation with 256 GB free disk space. The server is in a remote data center and you have VPN access. What is the BEST method to acquire the memory?
Select an answer first
29application · medium
A forensic examiner is documenting a live acquisition. The examiner has recorded the date, time, and the tool used. What additional information is required to complete the chain of custody documentation?
Select an answer first
30foundation · easy
Which tool can be used to perform memory acquisition on a live Windows system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.