Working with Evidence Files GBFA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An examiner is analyzing a memory dump from a compromised Windows system. The examiner needs to identify which processes were running at the time of the dump. Which tool and technique would be most effective?

   • AUse Volatility with the 'pslist' plugin to list processes from the memory dump.
   • BUse FTK Imager to open the memory dump and view running processes.
   • CUse Wireshark to analyze the memory dump for network connections.
   • DUse the 'strings' command to search for process names in the memory dump.
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A forensic examiner receives a file with a .dd extension. What does this indicate, and what is a common use for this format?

   • AIt is a compressed archive format, commonly used for storing multiple files.
   • BIt is a memory dump format, commonly used for analyzing RAM contents.
   • CIt is a raw disk image format, commonly used for forensic imaging and analysis.
   • DIt is a database file format, commonly used for storing structured data.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of calculating a cryptographic hash (e.g., SHA-256) of an evidence file?

   • ATo compress the evidence file for storage
   • BTo encrypt the evidence file
   • CTo verify the integrity of the evidence file
   • DTo index the evidence file for faster search
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which basic analysis technique is used to recover deleted files from an evidence image?

   • ANetwork packet analysis
   • BLog analysis
   • CPassword cracking
   • DFile carving
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A forensic examiner is preparing to testify about an evidence file. The examiner's chain-of-custody form shows that the evidence file was transferred from the examiner to a lab technician, but there is no record of the technician returning the file to the examiner. The examiner later received the file back from the technician. What is the most appropriate action to address this gap?

   • ADocument the gap in the chain-of-custody form and explain the circumstances in the final report
   • BAsk the lab technician to sign a new form that includes the return date
   • CIgnore the gap because the evidence file's hash is still valid
   • DBackdate the chain-of-custody form to show the return was recorded
   Reveal Solution Discussion Select an answer first