You are explaining to a junior investigator why a solid-state drive (SSD) might behave differently during acquisition than a hard disk drive (HDD). Which statement is accurate?

SSDs store data in flash memory cells, and the controller may move or erase data during idle time, so imaging should be done promptly.

SSDs are always faster to image because they have no moving parts.

SSDs store data magnetically on sectors, so write blockers are not needed.

SSDs have platters and sectors, so they require the same imaging process as HDDs.

You are preparing to acquire a forensic image of a desktop computer's internal drive. The drive is a 3.5-inch SATA HDD. Which write-blocker connection is appropriate for this task?

A Thunderbolt 3 to SATA adapter without write-blocking

A direct SATA connection to the motherboard without a write-blocker

A USB write-blocker with a SATA-to-USB adapter cable

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 3

Physical Storage Devices GBFA Practice Questions (Page 7)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

4concepts

Questions 31–33

31foundation · easy
On a traditional hard disk drive, what is the smallest addressable unit of storage that is typically 512 bytes or 4,096 bytes in size?
Select an answer first
32application · medium
You are explaining to a junior investigator why a solid-state drive (SSD) might behave differently during acquisition than a hard disk drive (HDD). Which statement is accurate?
Select an answer first
33application · medium
You are preparing to acquire a forensic image of a desktop computer's internal drive. The drive is a 3.5-inch SATA HDD. Which write-blocker connection is appropriate for this task?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Physical Storage Devices GBFA Practice Questions (Page 7)

Questions 31–33

On a traditional hard disk drive, what is the smallest addressable unit of storage that is typically 512 bytes or 4,096 bytes in size?

You are explaining to a junior investigator why a solid-state drive (SSD) might behave differently during acquisition than a hard disk drive (HDD). Which statement is accurate?

You are preparing to acquire a forensic image of a desktop computer's internal drive. The drive is a 3.5-inch SATA HDD. Which write-blocker connection is appropriate for this task?

Keep studying — Foundations and Preparation