A forensic examiner is documenting the chain of custody for a hard drive that has been analyzed by multiple examiners. What is the correct way to document each transfer?

The lead examiner should sign for all transfers to simplify the documentation.

Only the first examiner needs to sign the form; subsequent examiners can be listed in the final report.

Transfers can be documented verbally and noted in the final report.

Each examiner should sign and date the chain-of-custody form when they receive and return the evidence.

What is the first step in analyzing an evidence file to extract information?

Verify the integrity of the evidence file using a hash

An examiner has an AFF4 evidence file and wants to verify that the file has not been tampered with since it was created. The examiner has access to the original SHA-256 hash recorded in the acquisition report. Which action best verifies the integrity of the AFF4 file?

Open the AFF4 file in a forensic tool and check that the file system is recognized

Verify that the AFF4 file's internal metadata matches the case number

Compute the SHA-256 hash of the AFF4 file and compare it to the recorded hash

Check the file's creation date and time in the operating system

An examiner needs to acquire a forensic image of a RAID 5 array from a server that is still running. The server is critical and cannot be shut down. The examiner has access to the server's logical volume manager. Which acquisition method is most appropriate?

Remove the individual drives from the RAID array and image them separately.

Perform a logical acquisition of the mounted logical volume using a forensic tool that supports live imaging.

Use a hardware RAID controller's built-in imaging feature to create a physical image.

Power off the server and then connect the RAID drives to a forensic workstation for imaging.

An examiner creates an E01 evidence file and then uses the same tool to verify the file's integrity by comparing the embedded hash with a newly computed hash. The verification fails. What is the most likely cause and the appropriate next step?

The E01 file may have been corrupted during storage or transfer; re-acquire the evidence if possible

The examiner opened the file in a text editor, which changed the file; close the editor and retry

The E01 file is compressed and the hash is computed on the compressed data; decompress first

The examiner used the wrong hash algorithm; try a different algorithm

GIAC Battlefield Forensics and Acquisition

Domain 5Objective 2

Working with Evidence Files GBFA Practice Questions (Page 6)

Part of the Network and Evidence Handling domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 26–30

26application · medium
A forensic examiner is documenting the chain of custody for a hard drive that has been analyzed by multiple examiners. What is the correct way to document each transfer?
Select an answer first
27foundation · easy
What is the first step in analyzing an evidence file to extract information?
Select an answer first
28application · medium
An examiner has an AFF4 evidence file and wants to verify that the file has not been tampered with since it was created. The examiner has access to the original SHA-256 hash recorded in the acquisition report. Which action best verifies the integrity of the AFF4 file?
Select an answer first
29expert · hard
An examiner needs to acquire a forensic image of a RAID 5 array from a server that is still running. The server is critical and cannot be shut down. The examiner has access to the server's logical volume manager. Which acquisition method is most appropriate?
Select an answer first
30application · medium
An examiner creates an E01 evidence file and then uses the same tool to verify the file's integrity by comparing the embedded hash with a newly computed hash. The verification fails. What is the most likely cause and the appropriate next step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.