You are at a crime scene with a desktop PC that has an SSD with a SATA interface. The SSD is connected to a SATA port on the motherboard. You have a hardware write blocker that supports SATA. However, the write blocker's power cable is not available. You have a spare SATA power cable from another PC. What is the most appropriate action?

Use the spare SATA power cable to power the write blocker, ensuring the write blocker is connected between the SSD and the forensic workstation.

Use a USB-to-SATA adapter with the write blocker, but do not power the write blocker.

Image the SSD using a software tool that supports SATA, without a write blocker.

Connect the SSD directly to the forensic workstation's SATA port without a write blocker.

You are acquiring a drive from a server that uses a SAS interface. You have a write blocker that only supports SATA. What is the best course of action?

Image the drive using a software tool that supports SAS, without a write blocker.

Obtain a SAS-capable write blocker or use a forensic workstation with a SAS controller that supports write protection.

Use a USB-to-SAS adapter and image the drive as a removable disk.

Connect the SAS drive to the SATA write blocker using a SAS-to-SATA adapter.

You are documenting a seized external drive that has a USB 3.0 connector, but the drive's label is missing. The device manager shows it as a 'WD My Passport 2TB'. You need to determine the internal interface (SATA or IDE) for acquisition. Which method is most reliable?

Try to image the drive through the USB bridge without opening it.

Assume it is SATA because it is a modern drive.

Open the external enclosure and visually inspect the drive's connector.

Use the USB bridge chipset model to infer the interface.

You are documenting a seized external drive that connects via a USB bridge. The drive's label is missing, but the device manager shows it as a 'Samsung SSD 860 EVO 500GB'. Which information should you record for the chain of custody?

Only the USB connector type (e.g., USB-A or USB-C).

The drive's rotation speed and cache size.

The model name, capacity, and the USB bridge chipset if visible.

The drive's IP address and MAC address.

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 3

Physical Storage Devices GBFA Practice Questions (Page 2)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

Questions 6–10

6expert · hard
You are at a crime scene with a desktop PC that has an SSD with a SATA interface. The SSD is connected to a SATA port on the motherboard. You have a hardware write blocker that supports SATA. However, the write blocker's power cable is not available. You have a spare SATA power cable from another PC. What is the most appropriate action?
Select an answer first
7foundation · easy
Which physical storage device type uses rotating platters and a read/write head to access data?
Select an answer first
8application · medium
You are acquiring a drive from a server that uses a SAS interface. You have a write blocker that only supports SATA. What is the best course of action?
Select an answer first
9expert · hard
You are documenting a seized external drive that has a USB 3.0 connector, but the drive's label is missing. The device manager shows it as a 'WD My Passport 2TB'. You need to determine the internal interface (SATA or IDE) for acquisition. Which method is most reliable?
Select an answer first
10application · medium
You are documenting a seized external drive that connects via a USB bridge. The drive's label is missing, but the device manager shows it as a 'Samsung SSD 860 EVO 500GB'. Which information should you record for the chain of custody?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Physical Storage Devices GBFA Practice Questions (Page 2)

Questions 6–10

Which physical storage device type uses rotating platters and a read/write head to access data?

You are acquiring a drive from a server that uses a SAS interface. You have a write blocker that only supports SATA. What is the best course of action?

You are documenting a seized external drive that has a USB 3.0 connector, but the drive's label is missing. The device manager shows it as a 'WD My Passport 2TB'. You need to determine the internal interface (SATA or IDE) for acquisition. Which method is most reliable?

You are documenting a seized external drive that connects via a USB bridge. The drive's label is missing, but the device manager shows it as a 'Samsung SSD 860 EVO 500GB'. Which information should you record for the chain of custody?

Keep studying — Foundations and Preparation