You are manually examining a Linux system image and need to find all files that contain a specific internal project codename. The codename is a single word that could appear in both text files and binary files. Which manual search strategy is most effective?

Use grep with the -a option to treat binary files as text and search recursively from the root directory.

Use a data carving tool to recover deleted files and then search those recovered files.

Use find with the -name option to locate files that have the codename in their filename.

Use strings on every file and pipe the output to grep, but only in the /home directory.

During a manual review of a Windows 10 image, you find a file named 'report.pdf' in the user's Downloads folder. The file's creation timestamp is older than the system installation date. What does this indicate?

The file was likely copied to the system from an external source, such as a USB drive or network share.

The file was created by the system during installation.

The file's timestamp is incorrect due to a system clock error.

The file was downloaded from the internet before the system was installed.

You have found a suspicious file on a forensic image and want to determine if the user intentionally downloaded it or if it was installed by malware. Which combination of manual findings would best support the conclusion of intentional download?

The file is located in the user's Downloads folder and has a .exe extension.

The file's access time is recent and the user was logged in at that time.

The file's metadata shows it was created by a known software vendor.

Browser history shows the file was downloaded from a website, and the file's creation time matches the download time.

You are manually examining a file found on a forensic image. The file's metadata shows a creation timestamp of January 1, 2023, but the system's clock was set to January 1, 2024, at the time of acquisition. What does this indicate?

The file was created by the system during the acquisition process.

The file was created in the future.

The file's timestamp is incorrect due to a system clock error.

The file was likely created on another system and copied to this system, preserving the original timestamp.

You are examining a suspicious document found on a forensic image. You need to determine whether the document was created on the system or copied from an external device. Which metadata examination is most useful?

Look at the file's size and compare it to known versions of the document.

Compare the document's creation timestamp with the system's file system journal to see if it was created during a known session.

Examine the document's author metadata to identify the original author.

Check the file's last access timestamp to see when it was last opened.

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 2

Manually Finding Data GBFA Practice Questions (Page 6)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 26–30

26application · medium
You are manually examining a Linux system image and need to find all files that contain a specific internal project codename. The codename is a single word that could appear in both text files and binary files. Which manual search strategy is most effective?
Select an answer first
27application · medium
During a manual review of a Windows 10 image, you find a file named 'report.pdf' in the user's Downloads folder. The file's creation timestamp is older than the system installation date. What does this indicate?
Select an answer first
28application · medium
You have found a suspicious file on a forensic image and want to determine if the user intentionally downloaded it or if it was installed by malware. Which combination of manual findings would best support the conclusion of intentional download?
Select an answer first
29application · medium
You are manually examining a file found on a forensic image. The file's metadata shows a creation timestamp of January 1, 2023, but the system's clock was set to January 1, 2024, at the time of acquisition. What does this indicate?
Select an answer first
30application · medium
You are examining a suspicious document found on a forensic image. You need to determine whether the document was created on the system or copied from an external device. Which metadata examination is most useful?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.