Physical Storage Devices GBFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A junior examiner asks why a hard disk drive (HDD) must be imaged in a cleanroom if the platters are exposed. Which explanation is correct?

   • AThe platters are made of glass and can shatter if exposed to air.
   • BThe platters are sensitive to dust and contamination, which can cause read errors or damage the magnetic surface.
   • CThe platters are magnetic and can be erased by static electricity in the air.
   • DThe platters must be kept at a specific temperature to prevent data loss.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   You are at a scene and find a device that is a small rectangular card with a 9-pin connector on one end and a label that says '128 GB'. It has no visible moving parts. Which type of storage device is this most likely to be?

   • AA USB flash drive
   • BAn mSATA SSD
   • CA microSD card
   • DA SATA SSD
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   You are at a crime scene and find a desktop computer with an older hard drive that uses a 40-pin ribbon cable. You need to acquire the drive. Which interface does this drive use, and what is the primary forensic implication?

   • ASATA; you can use a standard SATA write blocker.
   • BUSB; you can connect it via a USB adapter.
   • CIDE/PATA; you need a write blocker that supports IDE, and the drive may require jumper settings for master/slave.
   • DNVMe; you need an NVMe write blocker.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which physical attribute of a storage device is typically printed on the manufacturer's label and indicates the storage capacity, such as '1 TB'?

   • AInterface type
   • BCache size
   • CFirmware version
   • DCapacity
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A forensic examiner needs to acquire data from a laptop that was found in a water-damaged environment. The laptop's storage device is not spinning, and the examiner suspects it is an SSD. Which physical characteristic of SSDs is most relevant to the acquisition strategy?

   • ASSDs require a special write blocker that is different from HDD write blockers.
   • BSSDs have no moving parts, so they are less susceptible to physical shock, but water damage can still corrode the controller and flash chips.
   • CSSDs store data on platters, so they must be kept upright during acquisition.
   • DSSDs are immune to water damage because they have no moving parts.
   Reveal Solution Discussion Select an answer first