You are documenting a seized external drive. The drive's label is partially damaged, but you can read the model number and capacity. Which additional information is most important to record for forensic chain-of-custody and later identification?

The drive's color and physical condition

You are explaining to a colleague why a solid-state drive (SSD) may not retain deleted data as long as a hard disk drive (HDD). Which statement is correct?

SSDs are slower than HDDs, so deleted data is overwritten quickly.

SSDs store data on platters that degrade over time.

SSDs have a limited number of write cycles, so they automatically erase data to extend lifespan.

SSD controllers use TRIM and garbage collection, which can permanently erase deleted data blocks.

You are preparing to acquire a forensic image from a modern laptop that has an NVMe SSD. Which of the following is the most appropriate method to connect the drive to your forensic workstation?

Use an M.2 to USB NVMe enclosure with a write-blocker.

Use a USB-to-SATA adapter with a write-blocker.

Connect the SSD directly to a SATA port on the motherboard.

Use an IDE-to-USB adapter with a write-blocker.

You are at a scene where a suspect has a microSD card in a digital camera. You need to acquire the card. Which of the following is the most appropriate method?

Copy the files from the card to a folder on your workstation.

Remove the microSD card and use a forensic card reader with write-blocking capability.

Connect the camera to your forensic workstation via USB and image the card through the camera.

Use a standard USB card reader without write-blocking.

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 3

Physical Storage Devices GBFA Practice Questions (Page 5)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

Questions 21–25

21application · easy
You are documenting a seized external drive. The drive's label is partially damaged, but you can read the model number and capacity. Which additional information is most important to record for forensic chain-of-custody and later identification?
Select an answer first
22application · medium
You are explaining to a colleague why a solid-state drive (SSD) may not retain deleted data as long as a hard disk drive (HDD). Which statement is correct?
Select an answer first
23application · medium
You are preparing to acquire a forensic image from a modern laptop that has an NVMe SSD. Which of the following is the most appropriate method to connect the drive to your forensic workstation?
Select an answer first
24foundation · easy
Which storage interface is the oldest and uses a 40-pin ribbon cable, typically found in legacy systems?
Select an answer first
25application · medium
You are at a scene where a suspect has a microSD card in a digital camera. You need to acquire the card. Which of the following is the most appropriate method?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.