An investigator is documenting a triage of a server. The investigator used a triage tool to collect volatile data and then imaged the disk. Which documentation is necessary to show that the collected data has not been altered?

The brand of the triage tool used.

Hash values of the collected data before and after collection.

A forensic team is responding to a data breach at a hospital. The suspect system is a Windows workstation that is running and connected to the hospital network. The team has a limited budget and must choose between a commercial triage tool that is well-documented but expensive, and a free open-source tool that is less documented but widely used. The investigation may lead to litigation. Which tool selection is most appropriate?

Use both tools and compare results.

Use the free open-source tool because it is widely used and saves money.

Use the commercial tool because its documentation supports admissibility in court.

Skip triage and rely on the hospital's existing security logs.

During triage, an investigator must choose between collecting the system's RAM and capturing a logical image of the user's Documents folder. Which principle should guide the decision?

Collect the Documents folder first because it has higher evidentiary value

Collect the Documents folder first because it is easier to analyze

Collect both simultaneously to save time

Collect RAM first because it is more volatile

A forensic examiner is preparing to testify about a triage performed on a suspect machine. The defense attorney challenges the reliability of the triage tool used. What should the examiner have done during the triage to best support the tool's reliability?

Rely on the tool's built-in help documentation to explain its functionality in court.

Keep the tool's license key and purchase receipt to prove it was legally obtained.

Document the tool's name, version, and hash, and verify that the tool was obtained from a trusted source before use.

Use a different tool for each data type to avoid relying on a single tool's output.

GIAC Battlefield Forensics and Acquisition

Domain 6Objective 3

Using Forensic Tools for Triage GBFA Practice Questions (Page 6)

Part of the Triage and Manual Analysis domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

4concepts

Questions 26–30

26application · medium
An investigator is documenting a triage of a server. The investigator used a triage tool to collect volatile data and then imaged the disk. Which documentation is necessary to show that the collected data has not been altered?
Select an answer first
27expert · hard
A forensic team is responding to a data breach at a hospital. The suspect system is a Windows workstation that is running and connected to the hospital network. The team has a limited budget and must choose between a commercial triage tool that is well-documented but expensive, and a free open-source tool that is less documented but widely used. The investigation may lead to litigation. Which tool selection is most appropriate?
Select an answer first
28foundation · easy
During triage, an investigator must choose between collecting the system's RAM and capturing a logical image of the user's Documents folder. Which principle should guide the decision?
Select an answer first
29expert · hard
A forensic examiner is preparing to testify about a triage performed on a suspect machine. The defense attorney challenges the reliability of the triage tool used. What should the examiner have done during the triage to best support the tool's reliability?
Select an answer first
30foundation · easy
An investigator is triaging a live system and must prioritize data collection. Which of the following data sources should be collected FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Using Forensic Tools for Triage GBFA Practice Questions (Page 6)

Questions 26–30

An investigator is documenting a triage of a server. The investigator used a triage tool to collect volatile data and then imaged the disk. Which documentation is necessary to show that the collected data has not been altered?

During triage, an investigator must choose between collecting the system's RAM and capturing a logical image of the user's Documents folder. Which principle should guide the decision?

A forensic examiner is preparing to testify about a triage performed on a suspect machine. The defense attorney challenges the reliability of the triage tool used. What should the examiner have done during the triage to best support the tool's reliability?

An investigator is triaging a live system and must prioritize data collection. Which of the following data sources should be collected FIRST?

Keep studying — Triage and Manual Analysis