Working with Evidence Files GBFA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An examiner has an E01 image of a suspect's hard drive. The examiner needs to quickly find all deleted files that contain the word 'password' in their content. Which tool or technique is most appropriate for this task?

   • AUse a hex editor to manually search the image for the ASCII representation of 'password'.
   • BUse the 'strings' command on the raw image to extract all printable strings and then search for 'password'.
   • CUse a forensic tool like Autopsy or The Sleuth Kit to perform a keyword search across the image, including unallocated space and deleted files.
   • DMount the E01 image as a read-only drive and use Windows Search to find files containing 'password'.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A forensic lab receives a package containing a smartphone and a memory card. The packaging is not sealed and there is no documentation. What should the lab do to maintain the integrity of the evidence?

   • AReturn the items to the sender because the packaging is not sealed.
   • BPhotograph the items, place them in new evidence bags, seal them, and document the receipt in a chain-of-custody form.
   • CImmediately power on the smartphone to check if it works and then document the findings.
   • DPlace the items in a drawer and wait for the submitting officer to provide documentation later.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An examiner is analyzing a forensic image of a USB drive and needs to recover deleted files. The image was created with FTK Imager as an E01 file. Which approach is most effective for recovering deleted files?

   • AOpen the E01 file in a forensic tool like Autopsy and use the file recovery module to carve deleted files from unallocated space.
   • BUse the 'undelete' command in the Linux terminal after converting the E01 to a raw image.
   • CMount the E01 file as a virtual drive and use a data recovery program like Recuva on the mounted drive.
   • DUse the Windows 'recycle bin' to restore deleted files from the image.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which evidence file format is a raw, bit-for-bit copy of a storage device without any compression or metadata?

   • ADD (Raw Image)
   • BAFF (Advanced Forensic Format)
   • CE01 (Expert Witness Format)
   • DVMDK (Virtual Machine Disk)
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A forensic team is transporting a set of external hard drives containing raw evidence images from a field office to a central lab. The drives are not encrypted. The team wants to ensure the evidence remains intact and the chain of custody is preserved during transport. Which procedure is most appropriate?

   • APlace the drives in anti-static bags, pack them in a padded case, and have a courier sign a chain-of-custody form
   • BShip the drives via standard mail without any special packaging or documentation
   • CCopy the images to a cloud storage service and delete the local copies after upload
   • DEncrypt the drives using BitLocker before transport and document the recovery key in the case file
   Reveal Solution Discussion Select an answer first