Storage Technologies GBFA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which storage interface is designed specifically for high-speed communication with solid-state drives over the PCIe bus, often using M.2 or U.2 form factors?

   • ANVMe
   • BUSB
   • CIDE
   • DSATA
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A forensic examiner is analyzing a disk image and finds that the partition table is missing. The examiner suspects that the partition was formatted with NTFS. Which method is most likely to recover the file system?

   • AUse the MFT to locate the partition boundaries.
   • BScan the raw disk for the NTFS boot sector signature (e.g., 'NTFS') and reconstruct the partition.
   • CFormat the disk with NTFS and then recover files.
   • DRecreate the partition table by guessing the partition size and type.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic team is tasked with acquiring a laptop that contains an NVMe SSD. The laptop is running and the user is logged in. The team has a hardware write-blocker that supports NVMe via USB, but the laptop does not have a USB port that supports the write-blocker's required speed. The team also has a forensic workstation with a USB 3.0 port. Which action is most appropriate to acquire the SSD?

   • ABoot the laptop from a forensic live USB and acquire the SSD over the network to the forensic workstation.
   • BRemove the SSD from the laptop and connect it to the forensic workstation via the write-blocker, then image it.
   • CCreate a logical image of only the user's files using the operating system's backup tool, then verify the hash.
   • DUse the laptop's built-in USB port to connect the write-blocker, even though it is slower, and image the SSD in place.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An examiner must acquire a laptop that has a hardware-encrypted SSD and the user is logged in. The examiner has legal authority to seize the laptop. Which acquisition method is most likely to preserve the most evidence?

   • AUse the laptop's built-in backup utility to copy the decrypted data to an external drive.
   • BPerform a live acquisition while the laptop is running, capturing the decrypted data.
   • CRemove the SSD and image it with a hardware write-blocker while the laptop is still running.
   • DShut down the laptop and image the SSD with a hardware write-blocker.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic examiner needs to acquire a solid-state drive (SSD) from a suspect's laptop. The SSD supports NVMe and is currently installed in the laptop. The examiner wants to minimize the risk of the SSD's garbage collection or TRIM altering data during acquisition. Which approach is most appropriate?

   • AUse the laptop's built-in SATA port to connect the SSD to a write-blocker, as NVMe SSDs are backward-compatible with SATA.
   • BRemove the SSD and acquire it using a hardware write-blocker that supports NVMe, without booting the laptop.
   • CAcquire the SSD over the network using a forensic tool while the laptop is running, then verify the image hash.
   • DBoot the laptop with a forensic live CD and acquire the SSD while the operating system is not running.
   Reveal Solution Discussion Select an answer first