Working with Evidence Files GBFA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A forensic examiner is preparing to document the chain of custody for a mobile phone that was seized at a crime scene. The phone was turned off and placed in a Faraday bag. The examiner needs to document the seizure. What is the most important information to include?

   • AThe name of the forensic lab that will analyze the phone.
   • BThe date, time, location of seizure, the officer who seized it, and the phone's unique identifiers (IMEI/MEID).
   • CThe phone's battery level and charging status.
   • DThe phone's wallpaper and screen lock settings.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A field examiner acquires a logical image of a suspect's USB drive using FTK Imager and saves it as an E01 file. The examiner must later present the image in court and needs to demonstrate that the file has not been altered since acquisition. Which action best supports the integrity and admissibility of the evidence?

   • ACopy the E01 file to a network share and rely on the file's built-in CRC32 checksum to prove authenticity.
   • BStore the E01 file on a write-protected external drive and record its SHA-256 hash in the chain-of-custody documentation.
   • CConvert the E01 file to a raw DD image to simplify later analysis and reduce the risk of corruption.
   • DRename the E01 file to include the acquisition date and examiner initials to ensure proper identification.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An examiner needs to acquire a solid-state drive (SSD) that is suspected of containing deleted files. The SSD supports the TRIM command. The examiner wants to maximize the chance of recovering deleted data. Which acquisition approach is most appropriate?

   • ABoot the system and use a live acquisition tool to capture the SSD
   • BCopy the SSD's contents to another drive using the operating system's copy command
   • CPerform a dead acquisition immediately using a write blocker to create a raw image
   • DRun a secure erase on the SSD before acquisition to ensure a clean image
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An examiner needs to acquire the contents of a live Windows system's RAM as part of an incident response. The system is running critical services that cannot be stopped. Which tool and approach should the examiner use?

   • AUse FTK Imager to create a physical image of the hard drive while the system is running.
   • BUse the built-in Windows 'copy' command to copy the pagefile.sys file to an external drive.
   • CUse a trusted memory acquisition tool like WinPmem or Magnet RAM Capture to dump RAM to an external forensic drive.
   • DPower off the system and then remove the RAM modules for physical imaging.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An examiner has two evidence files: a raw image and an E01 file of the same drive. The examiner computes the SHA-256 hash of the raw image and the MD5 hash of the E01 file. Both hashes match the values recorded at acquisition. However, the examiner notices that the E01 file's internal metadata shows a different acquisition date than the raw image's file timestamp. What is the most appropriate conclusion?

   • AThe E01 file has been tampered with because the metadata does not match the raw image
   • BThe examiner should re-acquire the drive because the two files are inconsistent
   • CThe E01 file's internal metadata may be inaccurate, but the file's integrity is still verified by the matching hash
   • DThe raw image is invalid because its hash algorithm is weaker than the E01's
   Reveal Solution Discussion Select an answer first