Why is it essential to document every action taken during a live acquisition?

To speed up the acquisition process

To avoid the need for a search warrant

To ensure the system does not crash

To maintain the chain of custody and ensure the evidence is admissible in court

A responder is called to a site where a user is suspected of copying sensitive files to a USB drive. The system is on and the user is still logged in. Which volatile data should be collected FIRST to preserve the most ephemeral evidence?

Contents of the USB drive's file system.

During an incident response on a compromised Windows server, the lead investigator instructs you to begin live acquisition. The system is still running and network connectivity is active. Which action should you take FIRST to preserve the most volatile evidence?

Run a command to list active network connections and save the output to a file on the same system.

Capture the contents of physical memory using a trusted memory acquisition tool on removable media.

Copy the system's page file to an external forensic drive for later analysis.

Shut down the system gracefully to preserve the integrity of the hard drive.

An analyst is performing live acquisition on a Linux server suspected of running a cryptocurrency miner. The system has been up for weeks and the attacker may have hidden processes. Which set of commands should the analyst run to capture the most useful system state data?

Run 'ls -la /etc' and 'cat /etc/passwd' and save the output to a file.

Run 'history' and 'last' to review user commands and logins.

Run 'ps aux' and 'netstat -tulpn' and save the output to an external drive.

Run 'df -h' and 'free -m' to check disk and memory usage.

During a live acquisition, you use a trusted tool to capture memory and system state. After the acquisition, you need to document the process for chain of custody. Which documentation step is MOST critical to include?

List the software installed on the forensic workstation.

Record the date, time, and cryptographic hash of each acquired image.

Describe the suspect's desktop wallpaper.

Note the color of the external drive used for storage.

GIAC Battlefield Forensics and Acquisition

Domain 3Objective 2

Host Based Live Acquisition GBFA Practice Questions (Page 8)

Part of the Acquisition Techniques domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~12–18 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

8concepts

Questions 36–40

36foundation · easy
Why is it essential to document every action taken during a live acquisition?
Select an answer first
37application · medium
A responder is called to a site where a user is suspected of copying sensitive files to a USB drive. The system is on and the user is still logged in. Which volatile data should be collected FIRST to preserve the most ephemeral evidence?
Select an answer first
38application · medium
During an incident response on a compromised Windows server, the lead investigator instructs you to begin live acquisition. The system is still running and network connectivity is active. Which action should you take FIRST to preserve the most volatile evidence?
Select an answer first
39application · medium
An analyst is performing live acquisition on a Linux server suspected of running a cryptocurrency miner. The system has been up for weeks and the attacker may have hidden processes. Which set of commands should the analyst run to capture the most useful system state data?
Select an answer first
40application · medium
During a live acquisition, you use a trusted tool to capture memory and system state. After the acquisition, you need to document the process for chain of custody. Which documentation step is MOST critical to include?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.