You are documenting a seized laptop that has an M.2 SSD. You need to record the interface type. Which of the following is the best way to determine whether the M.2 SSD uses SATA or NVMe?

Check the M.2 connector key (B or M) and the drive's label or documentation.

Look at the number of pins on the connector.

Measure the physical length of the M.2 card.

You are preparing to image a laptop that was seized in a fraud investigation. The laptop has an M.2 NVMe SSD. You have a hardware write blocker that only supports SATA and a forensic workstation with an available USB 3.0 port. What is the most appropriate course of action?

Connect the NVMe SSD directly to the workstation's M.2 slot and image it without a write blocker.

Use the SATA write blocker with an M.2-to-SATA adapter.

Use a USB-to-NVMe adapter with the write blocker in a USB-bridge mode, if supported, or acquire via a forensic NVMe write blocker.

Remove the SSD and place it in a USB enclosure that supports NVMe, then image it as a removable disk.

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 3

Physical Storage Devices GBFA Practice Questions (Page 6)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

Questions 26–30

26foundation · easy
In solid-state drives (SSDs), what physical component stores data by trapping electric charge?
Select an answer first
27foundation · easy
Which storage device type is most likely to be found in a small, portable form factor and uses NAND flash memory for data storage?
Select an answer first
28foundation · easy
When documenting a storage device for forensic purposes, which attribute is essential to record to uniquely identify the device?
Select an answer first
29application · medium
You are documenting a seized laptop that has an M.2 SSD. You need to record the interface type. Which of the following is the best way to determine whether the M.2 SSD uses SATA or NVMe?
Select an answer first
30application · medium
You are preparing to image a laptop that was seized in a fraud investigation. The laptop has an M.2 NVMe SSD. You have a hardware write blocker that only supports SATA and a forensic workstation with an available USB 3.0 port. What is the most appropriate course of action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Physical Storage Devices GBFA Practice Questions (Page 6)

Questions 26–30

In solid-state drives (SSDs), what physical component stores data by trapping electric charge?

Which storage device type is most likely to be found in a small, portable form factor and uses NAND flash memory for data storage?

When documenting a storage device for forensic purposes, which attribute is essential to record to uniquely identify the device?

You are documenting a seized laptop that has an M.2 SSD. You need to record the interface type. Which of the following is the best way to determine whether the M.2 SSD uses SATA or NVMe?

You are preparing to image a laptop that was seized in a fraud investigation. The laptop has an M.2 NVMe SSD. You have a hardware write blocker that only supports SATA and a forensic workstation with an available USB 3.0 port. What is the most appropriate course of action?

Keep studying — Foundations and Preparation