A forensic team is transporting multiple hard drives from a crime scene to a forensic lab. The drives are not write-protected. What is the most important step to prevent accidental modification of the evidence during transport?

Use a hardware write-blocker when connecting the drives to any computer for verification or inventory.

Take photographs of the drives before and after transport to document their condition.

Place each drive in an anti-static bag and then in a padded container to prevent physical damage.

Label each drive with a unique evidence number and record it in the chain-of-custody form.

A forensic analyst receives a hard drive from a law enforcement officer. The officer provides no documentation. To ensure the evidence is admissible, what should the analyst do first?

Place the drive in a secure evidence locker and note the time of receipt in a personal notebook.

Immediately begin imaging the drive to avoid any delay that could be questioned in court.

Create a new chain-of-custody form that documents the transfer from the officer to the analyst, including date, time, and a description of the item.

Return the drive to the officer and refuse to accept it without proper documentation.

What is the primary reason for using a write-blocker during evidence acquisition?

To increase the speed of the acquisition

To prevent any modification to the original evidence

A forensic examiner is documenting the acquisition of a hard drive. The examiner notes the date, time, location, and the person who performed the acquisition. What additional information is essential to include in the chain-of-custody documentation?

The serial number of the hard drive and a description of the computer system it was removed from.

The name of the forensic tool used and the version number.

The brand of the hard drive and the color of the computer case.

The weather conditions at the time of acquisition.

What is the primary purpose of a chain of custody document?

To list the tools used during acquisition

To record every person who handled the evidence and when

To describe the physical characteristics of the evidence

To provide a summary of the forensic analysis results

GIAC Battlefield Forensics and Acquisition

Domain 5Objective 2

Working with Evidence Files GBFA Practice Questions (Page 1)

Part of the Network and Evidence Handling domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 1–5

1application · medium
A forensic team is transporting multiple hard drives from a crime scene to a forensic lab. The drives are not write-protected. What is the most important step to prevent accidental modification of the evidence during transport?
Select an answer first
2application · medium
A forensic analyst receives a hard drive from a law enforcement officer. The officer provides no documentation. To ensure the evidence is admissible, what should the analyst do first?
Select an answer first
3foundation · easy
What is the primary reason for using a write-blocker during evidence acquisition?
Select an answer first
4application · medium
A forensic examiner is documenting the acquisition of a hard drive. The examiner notes the date, time, location, and the person who performed the acquisition. What additional information is essential to include in the chain-of-custody documentation?
Select an answer first
5foundation · easy
What is the primary purpose of a chain of custody document?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.