An examiner is preparing to acquire a laptop that has an NVMe SSD. The examiner has a hardware write-blocker that supports SATA and USB interfaces. What is the most appropriate way to acquire the NVMe SSD?

Use an NVMe-to-USB adapter with a hardware write-blocker that supports NVMe.

Connect the NVMe SSD to a SATA port using a simple adapter.

Remove the NVMe SSD and connect it directly to the motherboard's M.2 slot on the forensic workstation.

Boot the laptop from a forensic live CD and use software write-blocking to image the NVMe SSD.

A forensic examiner is analyzing a disk image and needs to locate the file system that contains user data. The disk has multiple partitions. Which structure should the examiner examine first to identify the partitions and their file systems?

The partition table, which lists the starting sectors and types of each partition.

The file system journal, which records metadata changes.

The boot sector of the entire disk, which contains the file system type.

The Master File Table (MFT), which contains file system metadata.

During a forensic examination, an examiner is analyzing a disk image and needs to understand how a logical file is stored on the physical disk. The file system is NTFS. Which sequence correctly describes the hierarchy from the logical file to the physical sectors?

Logical file → MFT entry → data runs → logical cluster numbers → physical sectors

Logical file → partition table → boot sector → physical sectors

Logical file → directory entry → file allocation table → physical sectors

Logical file → inode → block pointers → physical sectors

A forensic examiner is analyzing a disk image from a Windows system. The examiner finds a partition that is formatted with the exFAT file system. Which characteristic of exFAT is most relevant for forensic analysis?

exFAT uses inodes and block pointers similar to ext4.

exFAT uses a Master File Table (MFT) to store file metadata.

exFAT does not support file deletion, so deleted files cannot be recovered.

exFAT uses a file allocation table similar to FAT32 but supports larger files and volumes.

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 4

Storage Technologies GBFA Practice Questions (Page 6)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 26–30

26application · medium
An examiner is preparing to acquire a laptop that has an NVMe SSD. The examiner has a hardware write-blocker that supports SATA and USB interfaces. What is the most appropriate way to acquire the NVMe SSD?
Select an answer first
27application · easy
A forensic examiner is analyzing a disk image and needs to understand the relationship between clusters and sectors. The file system uses 8 sectors per cluster, and each sector is 512 bytes. What is the cluster size in bytes?
Select an answer first
28application · medium
A forensic examiner is analyzing a disk image and needs to locate the file system that contains user data. The disk has multiple partitions. Which structure should the examiner examine first to identify the partitions and their file systems?
Select an answer first
29application · medium
During a forensic examination, an examiner is analyzing a disk image and needs to understand how a logical file is stored on the physical disk. The file system is NTFS. Which sequence correctly describes the hierarchy from the logical file to the physical sectors?
Select an answer first
30application · medium
A forensic examiner is analyzing a disk image from a Windows system. The examiner finds a partition that is formatted with the exFAT file system. Which characteristic of exFAT is most relevant for forensic analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.