Physical Storage Devices GBFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A field investigator hands you a USB flash drive from a crime scene. You need to preserve its contents. The drive is recognized by your forensic workstation as a removable disk. Which of the following is the most important consideration when acquiring this device?

   • AUse a write blocker that supports USB and verify that the device is mounted read-only.
   • BConnect the drive to a forensic workstation with a USB 3.0 port and use a Linux 'dd' command.
   • CDocument the drive's serial number and capacity, then image it using a hardware imager.
   • DImage the drive using a software tool that bypasses the operating system's cache.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a triage acquisition at a small office, you find a desktop PC with a 2.5-inch drive that has no spinning platters and uses NAND flash for storage. The drive connects via a flat ribbon cable to the motherboard. Which two physical attributes should you document first to ensure the correct write blocker and acquisition cable are selected?

   • AStorage technology (SSD), firmware version, and logical block size
   • BInterface (SATA), rotation speed (RPM), and cache size
   • CCapacity (e.g., 500 GB), manufacturer, and serial number
   • DForm factor (2.5-inch), interface (IDE), and storage technology (SSD)
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   You are documenting a seized external drive that has a label with the model number and capacity, but the serial number is scratched off. You need to identify the drive uniquely for chain-of-custody. Which of the following is the best alternative?

   • ADo not document the drive because it cannot be uniquely identified.
   • BRecord the model number and capacity, and note that the serial number is missing.
   • CEstimate the serial number based on the model number.
   • DUse the drive's file system UUID as the unique identifier.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You are acquiring a laptop with an NVMe SSD. The laptop is powered off, but you notice that the SSD's activity LED is blinking. What is the most likely explanation, and what should you do?

   • AThe SSD may be performing background operations such as garbage collection; you should immediately remove the SSD and acquire it using a write blocker.
   • BThe LED is a false positive; you can safely image the drive in place.
   • CThe SSD is failing; you should clone it using a hardware duplicator.
   • DThe SSD is infected with malware; you should boot the laptop to a forensic live CD.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A field agent brings you a USB flash drive that was found in a suspect's pocket. The drive is write-protected with a physical switch. What is the correct forensic procedure?

   • AUse a standard USB port without a write blocker because the switch protects the drive.
   • BVerify the switch is in the locked position and use a write blocker to acquire the drive.
   • CImage the drive using a software tool that ignores the write-protect switch.
   • DMove the switch to the unlocked position to allow the drive to be read.
   Reveal Solution Discussion Select an answer first