Using Forensic Tools for Triage GBFA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A forensic examiner is documenting a triage that involved multiple tools and a chain of custody that passed through several hands. The examiner needs to ensure that the documentation is legally defensible. Which documentation practice is most important?

   • ARecord every action taken, including tool names, versions, exact commands, timestamps, and the name of every person who handled the evidence, with signatures and dates.
   • BUse a single tool for the entire triage to simplify documentation, even if it means collecting less data.
   • CWrite a narrative summary of the triage in the final report, describing what was found.
   • DKeep a copy of the tool output on the examiner's personal laptop for easy access.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   During a triage of a suspect Windows workstation, an investigator needs to quickly capture running processes, network connections, and logged-on users without altering the system. Which tool is most appropriate for this task?

   • AFTK Imager
   • BCrowdResponse
   • CVolatility
   • DKAPE
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A responder is triaging a Windows 10 machine suspected of malware infection. The machine is running and the responder has a trusted USB toolkit. The responder needs to collect volatile data without altering the system more than necessary. Which tool usage is most appropriate for this task?

   • AInstall a commercial forensic suite on the suspect machine to ensure all data is collected with one tool.
   • BBoot the system into a Linux live CD and use dd to image the entire hard drive, then analyze the image later.
   • CUse the Windows 'copy' command to copy the pagefile.sys file to the USB drive, then run a network capture.
   • DRun a trusted memory acquisition tool from the USB kit to dump RAM to the external drive, then use built-in commands (e.g., netstat, tasklist) to capture network and process state.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A small law enforcement agency has a limited budget and needs to perform triage on Windows and Linux systems in the field. The investigators are not deeply technical but need to collect memory, network connections, and running processes quickly. Which tool selection is most appropriate for this context?

   • AA collection of open-source command-line tools that the investigators must run manually on each system.
   • BA hardware write blocker and a laptop with a disk-imaging application, used to image every suspect drive.
   • CA single-purpose memory acquisition tool that only works on Windows, since most cases involve Windows.
   • DA commercial triage tool with a GUI that supports both Windows and Linux, provides guided workflows, and logs all actions automatically.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A small law enforcement agency is preparing for a potential cybercrime investigation. They have limited budget and need to triage a Windows system that may contain evidence of fraud. The system is running, and they have a forensic laptop with write-blocker and imaging software. Which triage tool selection is most appropriate for this context?

   • AUse a free, well-documented triage tool that captures volatile data and hashes output.
   • BPurchase an expensive commercial suite with many features not needed for this case.
   • CSkip triage and immediately image the hard drive.
   • DUse a custom script written by an intern without documentation.
   Reveal Solution Discussion Select an answer first