An examiner has a raw image of a drive that contains a file system that is severely corrupted. The examiner needs to recover as many files as possible. The examiner has already tried parsing the file system metadata and found only a few files. Which analysis technique should the examiner use next?

Re-acquire the drive using a different tool to get a better image

Mount the image in a virtual machine and run a disk repair tool

Perform file carving on the raw image to recover files based on their signatures

Search the image for known file names using a hex editor

What is the recommended way to store digital evidence files long-term?

In a standard server room with no access restrictions

In a secure, climate-controlled environment with access controls

On a public cloud storage without encryption

A forensic examiner is documenting the acquisition of a computer's hard drive. The examiner uses a hardware write blocker and creates a raw image. The examiner then records the SHA-256 hash of the image in the case file. Which additional documentation is most important to include for a complete chain of custody?

The room temperature at the time of acquisition

The serial number of the write blocker used

The name and version of the imaging software used

The examiner's personal email address

A forensic examiner receives a memory dump file from a compromised server. The file has a .vmem extension. What does this indicate about the file, and what tool is commonly used to analyze it?

It is a virtual machine snapshot file, and it can only be analyzed by opening it in VMware Workstation.

It is a VMware virtual machine memory file, and Volatility is commonly used to analyze it.

It is a Windows crash dump file, and WinDbg is the only tool that can analyze it.

It is a raw memory dump from a physical machine, and FTK Imager is the primary tool for analysis.

A field examiner acquires a laptop hard drive using a write blocker and FTK Imager, creating a raw (DD) image and a separate SHA-1 hash file. The examiner then copies both files to a network share for the lab. Before the evidence is transported, the examiner wants to ensure the copy on the share is bit-for-bit identical to the original acquisition. Which action best verifies the integrity of the copied evidence files?

Recompute the SHA-1 hash of the copied image and compare it to the hash recorded at acquisition

Confirm the file size of the copied image matches the size reported by the write blocker

Check that the network share has sufficient free space for the image and hash files

Open the copied image in FTK Imager and browse a few folders to confirm readability

GIAC Battlefield Forensics and Acquisition

Domain 5Objective 2

Working with Evidence Files GBFA Practice Questions (Page 5)

Part of the Network and Evidence Handling domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 21–25

21expert · hard
An examiner has a raw image of a drive that contains a file system that is severely corrupted. The examiner needs to recover as many files as possible. The examiner has already tried parsing the file system metadata and found only a few files. Which analysis technique should the examiner use next?
Select an answer first
22foundation · easy
What is the recommended way to store digital evidence files long-term?
Select an answer first
23application · medium
A forensic examiner is documenting the acquisition of a computer's hard drive. The examiner uses a hardware write blocker and creates a raw image. The examiner then records the SHA-256 hash of the image in the case file. Which additional documentation is most important to include for a complete chain of custody?
Select an answer first
24application · medium
A forensic examiner receives a memory dump file from a compromised server. The file has a .vmem extension. What does this indicate about the file, and what tool is commonly used to analyze it?
Select an answer first
25application · medium
A field examiner acquires a laptop hard drive using a write blocker and FTK Imager, creating a raw (DD) image and a separate SHA-1 hash file. The examiner then copies both files to a network share for the lab. Before the evidence is transported, the examiner wants to ensure the copy on the share is bit-for-bit identical to the original acquisition. Which action best verifies the integrity of the copied evidence files?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Working with Evidence Files GBFA Practice Questions (Page 5)

Questions 21–25

An examiner has a raw image of a drive that contains a file system that is severely corrupted. The examiner needs to recover as many files as possible. The examiner has already tried parsing the file system metadata and found only a few files. Which analysis technique should the examiner use next?

What is the recommended way to store digital evidence files long-term?

A forensic examiner receives a memory dump file from a compromised server. The file has a .vmem extension. What does this indicate about the file, and what tool is commonly used to analyze it?

Keep studying — Network and Evidence Handling