An examiner receives a USB flash drive that was used to transfer files between computers. The drive is recognized by the examiner's workstation as a removable disk. Which acquisition method is most appropriate for this device?

Copy all visible files to the examiner's workstation using a standard file copy.

Use the operating system's format utility to create a fresh file system before imaging.

Boot the suspect's computer and use a software write-blocker to image the USB drive.

Connect the USB drive to a hardware write-blocker and create a full forensic image.

A forensic team is acquiring a laptop with a hybrid drive (HDD with a small SSD cache). The team has a hardware write-blocker that supports SATA. Which acquisition approach is most appropriate to ensure all data is captured?

Image the entire hybrid drive as a single device, including both the HDD and SSD cache, using the SATA write-blocker.

Remove the SSD cache and image it separately, then image the HDD.

Use a software tool to image only the active partition, as the cache is not part of the file system.

Image only the HDD portion, as the SSD cache is not considered evidence.

An examiner is at a scene and must acquire a MacBook that has a Thunderbolt 3 port and an NVMe SSD. The examiner has a hardware write-blocker that supports USB-C and SATA. Which acquisition method is most appropriate?

Boot the MacBook in target disk mode and use a USB-C cable to connect to the write-blocker.

Remove the NVMe SSD and connect it to the write-blocker's USB-C port using a USB-C to NVMe adapter.

Use a Thunderbolt 3 to NVMe adapter with a write-blocker that supports Thunderbolt 3.

Connect the NVMe SSD to the SATA port on the write-blocker using a simple adapter.

What is the primary purpose of a write blocker during forensic acquisition of a storage device?

To decrypt the data on the drive

To create a forensic image of the drive

To increase the speed of the acquisition

To prevent any modification to the original evidence

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 4

Storage Technologies GBFA Practice Questions (Page 1)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 1–5

1application · medium
An examiner receives a USB flash drive that was used to transfer files between computers. The drive is recognized by the examiner's workstation as a removable disk. Which acquisition method is most appropriate for this device?
Select an answer first
2expert · hard
A forensic team is acquiring a laptop with a hybrid drive (HDD with a small SSD cache). The team has a hardware write-blocker that supports SATA. Which acquisition approach is most appropriate to ensure all data is captured?
Select an answer first
3foundation · easy
During a forensic acquisition, an examiner encounters a storage device that uses NAND flash memory and has no moving parts. Which type of storage media is this device?
Select an answer first
4expert · hard
An examiner is at a scene and must acquire a MacBook that has a Thunderbolt 3 port and an NVMe SSD. The examiner has a hardware write-blocker that supports USB-C and SATA. Which acquisition method is most appropriate?
Select an answer first
5foundation · easy
What is the primary purpose of a write blocker during forensic acquisition of a storage device?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.