Physical Storage Devices GBFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which storage interface is commonly used for internal SSDs in modern laptops and desktops, connecting directly to the PCIe bus for high throughput?

   • AIDE (Integrated Drive Electronics)
   • BUSB (Universal Serial Bus)
   • CSATA (Serial ATA)
   • DNVMe (Non-Volatile Memory Express)
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You are explaining to a colleague why a forensic image of an SSD may not be as straightforward as imaging an HDD. Which factor is most relevant?

   • ASSDs have a lower capacity than HDDs, making imaging faster but less reliable.
   • BSSDs are always encrypted by default, preventing forensic imaging.
   • CSSDs use magnetic platters that require a special imaging device.
   • DSSDs use wear leveling and the TRIM command, which can cause data to be moved or erased automatically, affecting the integrity of the image.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are explaining to a junior examiner why a traditional HDD might retain data longer after a single overwrite compared to an SSD. Which physical characteristic best supports your explanation?

   • AHDDs use a write head that physically destroys the previous data, leaving no trace.
   • BHDDs store data as magnetic domains on platters, and overwriting may leave residual magnetism that can be partially recovered with specialized equipment.
   • CSSDs store data in flash cells that are physically larger than magnetic domains, making them easier to overwrite completely.
   • DSSDs have a limited number of write cycles, so they wear out faster and lose data naturally.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   You are acquiring a forensic image from a desktop computer that has both a SATA HDD and an NVMe SSD. You have a write-blocker that supports SATA but not NVMe. Which of the following is the most appropriate approach?

   • ASkip the HDD and only image the NVMe SSD.
   • BImage the NVMe SSD using the SATA write-blocker with an adapter.
   • CImage both drives simultaneously using a hardware RAID controller.
   • DImage the HDD first, then use a different write-blocker for the NVMe SSD.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   You are leading a forensic acquisition of a laptop that has been running for several hours. The drive is an SSD. You need to preserve as much data as possible. Which of the following actions is most likely to preserve the most data?

   • APut the laptop to sleep and then remove the SSD.
   • BImmediately power off the laptop and remove the SSD for imaging.
   • CRun a secure erase on the SSD before imaging.
   • DLeave the laptop running and perform a live acquisition.
   Reveal Solution Discussion Select an answer first