A forensic examiner is asked to acquire a Linux server that uses the ext4 file system. The server is running and cannot be shut down immediately. Which acquisition method is most appropriate?

Create a forensic image of the entire disk using a hardware write-blocker after removing the disk.

Copy only the files that are currently open using a file-level copy tool.

Perform a logical acquisition of the mounted file system using a tool like dd while the system is running.

Use the ext4 journal to reconstruct the file system state at a previous point in time.

A forensic examiner is analyzing a disk image and finds that the file system's superblock is corrupted. The examiner needs to recover data from the partition. Which approach is most likely to succeed?

Ignore the superblock and directly scan the raw disk for file signatures.

Use a backup superblock, which is stored at a known offset in the partition.

Use the journal to replay transactions and rebuild the superblock.

Reformat the partition to recreate the superblock, then recover files.

A field examiner must acquire a laptop that has been running for several hours and contains a SATA SSD. The examiner has a hardware write-blocker and a forensic imaging workstation. Which acquisition approach is most appropriate for preserving the evidentiary value of the SSD?

Boot the laptop from a forensic live CD and use software write-blocking to image the SSD over the network.

Remove the SSD, connect it to the write-blocker, and create a full forensic image.

Perform a live acquisition while the laptop is running, capturing only the files that are currently open.

Use the laptop's built-in backup utility to copy the SSD contents to an external drive.

An examiner is at a crime scene and must acquire a desktop computer that has a SATA hard drive. The examiner has a hardware write-blocker that only supports IDE and USB interfaces. The computer is powered off. Which action is most appropriate?

Boot the computer from a forensic live CD and use software write-blocking to image the drive.

Remove the SATA drive and use a SATA-to-USB adapter with the write-blocker.

Use a USB docking station without a write-blocker to image the drive.

Connect the SATA drive directly to the IDE port on the write-blocker using a cable adapter.

GIAC Battlefield Forensics and Acquisition

Domain 1Objective 4

Storage Technologies GBFA Practice Questions (Page 7)

Part of the Foundations and Preparation domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 3–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

5concepts

Questions 31–35

31application · medium
A forensic examiner is asked to acquire a Linux server that uses the ext4 file system. The server is running and cannot be shut down immediately. Which acquisition method is most appropriate?
Select an answer first
32expert · hard
A forensic examiner is analyzing a disk image that contains a partition with a file system that uses 4KB clusters. The examiner needs to locate the physical sectors of a file that starts at cluster 100. The partition starts at LBA 2048. What is the starting physical sector of the file's data?
Select an answer first
33expert · hard
A forensic examiner is analyzing a disk image and finds that the file system's superblock is corrupted. The examiner needs to recover data from the partition. Which approach is most likely to succeed?
Select an answer first
34application · medium
A field examiner must acquire a laptop that has been running for several hours and contains a SATA SSD. The examiner has a hardware write-blocker and a forensic imaging workstation. Which acquisition approach is most appropriate for preserving the evidentiary value of the SSD?
Select an answer first
35expert · hard
An examiner is at a crime scene and must acquire a desktop computer that has a SATA hard drive. The examiner has a hardware write-blocker that only supports IDE and USB interfaces. The computer is powered off. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.