Remote Acquisition GBFA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   What is the first step in creating a forensic image of a remote system over a network?

   • AEstablish a secure and authorized connection to the remote system.
   • BFormat the remote disk to ensure a clean image.
   • CCalculate the hash of the remote disk before imaging.
   • DDisconnect the remote system from the network to prevent changes.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A forensic examiner is asked to remotely acquire data from a personal smartphone that is connected to the corporate Wi-Fi network. The phone is owned by an employee, and the company's bring-your-own-device (BYOD) policy states that the company may access corporate data on the device but not personal data. The examiner needs to acquire evidence of a policy violation involving corporate email. Which approach is most appropriate?

   • AAcquire the entire device image to ensure no evidence is missed.
   • BAsk the employee for consent to acquire the entire device.
   • CSeize the phone and perform a physical acquisition.
   • DAcquire only the corporate email data from the device using a remote agent that is scoped to the corporate container.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A forensic team must create a forensic image of a remote Windows server over a 1 Gbps network. The server is in a different building and the only access is through a VPN. The team has a forensic imaging tool that supports network imaging. The image must be verified with a hash. During the imaging process, the network connection drops intermittently. Which approach ensures a complete and verifiable image?

   • AUse a tool that only supports one-shot imaging and rely on the VPN to maintain the connection.
   • BUse a network imaging tool that supports resumable transfers and verify the final image with a hash after completion.
   • CStart the imaging process and hope the network stays stable; if it drops, restart from the beginning.
   • DCreate a compressed image to reduce transfer time, but do not verify the hash because compression changes the data.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A law enforcement team has a warrant to seize a suspect's laptop, but the device is located in a remote branch office and cannot be physically transported. The team needs to acquire a forensic image over the corporate network. The laptop is running Windows 10 with BitLocker enabled, and the branch office is connected via a site-to-site VPN. Which approach best ensures a forensically sound acquisition while maintaining legal compliance?

   • ARemotely disable BitLocker via the corporate management console, then use PowerShell to copy the entire C: drive to a network location.
   • BAsk the branch office manager to power on the laptop and run a built-in backup tool to copy the user's files to a network share, then hash the files locally.
   • CDeploy a remote forensic agent to the laptop over the VPN, authenticate with the suspect's credentials, and capture a logical image of the active filesystem.
   • DUse a network boot (PXE) to start the laptop into a forensic environment, then image the physical disk over the VPN using an encrypted channel, while ensuring the warrant explicitly authorizes remote acquisition.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A forensic examiner has completed a remote acquisition of a server's disk. The examiner wants to ensure that the image has not been altered during the transfer. Which action is most appropriate?

   • AOpen the image in a forensic tool and verify that the filesystem is readable.
   • BCompare the modification timestamps of the image file.
   • CCheck the file size to ensure it matches the expected size.
   • DCompute a SHA-256 hash of the image file and compare it to the hash provided by the acquisition tool.
   Reveal Solution Discussion Select an answer first