You are performing a manual review of a forensic image and need to identify all user documents that may contain sensitive information. Which systematic manual search method is most appropriate?

Run a timeline analysis and review files created during business hours.

Examine the MFT for all file entries and review each one.

Navigate to common user document locations (e.g., Documents, Desktop, Downloads) and review file names and extensions.

Search the entire image for the string 'confidential' and review all hits.

What is the goal of correlating findings from multiple sources during manual analysis?

To reduce the number of files to analyze

To build a coherent picture of user activity

To create a backup of the evidence

You are manually analyzing a Windows system image and need to determine the order of user actions on a specific day. You have access to file system metadata, browser history, and the Windows Prefetch folder. Which manual method is most effective?

Review the Prefetch files to see which programs were run, but ignore file timestamps.

Look at the user's Documents folder to see which files were recently modified.

Construct a timeline by correlating timestamps from file metadata, browser history, and Prefetch files.

Examine only the browser history to determine the user's actions.

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 2

Manually Finding Data GBFA Practice Questions (Page 7)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

8concepts

Questions 31–35

31application · medium
You are performing a manual review of a forensic image and need to identify all user documents that may contain sensitive information. Which systematic manual search method is most appropriate?
Select an answer first
32foundation · easy
What is the goal of correlating findings from multiple sources during manual analysis?
Select an answer first
33application · medium
You are manually analyzing a Windows system image and need to determine the order of user actions on a specific day. You have access to file system metadata, browser history, and the Windows Prefetch folder. Which manual method is most effective?
Select an answer first
34foundation · easy
Which file signature is commonly used to identify JPEG images during data carving?
Select an answer first
35foundation · easy
Which metadata attribute is most useful for determining when a file was last modified?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Manually Finding Data GBFA Practice Questions (Page 7)

Questions 31–35

You are performing a manual review of a forensic image and need to identify all user documents that may contain sensitive information. Which systematic manual search method is most appropriate?

What is the goal of correlating findings from multiple sources during manual analysis?

You are manually analyzing a Windows system image and need to determine the order of user actions on a specific day. You have access to file system metadata, browser history, and the Windows Prefetch folder. Which manual method is most effective?

Which file signature is commonly used to identify JPEG images during data carving?

Which metadata attribute is most useful for determining when a file was last modified?

Keep studying — Triage and Manual Analysis