A forensic lab receives a set of evidence files on an encrypted USB drive. The courier provides the password in a separate email. The lab manager wants to ensure the evidence is handled properly while maintaining chain of custody. Which procedure is most appropriate?

Store the USB drive and the password in the same locked drawer without logging access

Copy the files to the lab server without decrypting, using the password only if needed

Ask the courier to decrypt the drive before handing it over, then sign the chain-of-custody form

Decrypt the USB drive, verify the hashes of the evidence files, and log the decryption and verification in the chain-of-custody form

A forensic examiner creates an E01 evidence file from a suspect's SSD. The examiner then transfers the E01 file to a lab server via an encrypted channel. Later, the examiner opens the E01 file in the lab and notices that the case number embedded in the E01 metadata is incorrect. What is the most appropriate action to maintain proper evidence handling and documentation?

Delete the E01 file and rely on the examiner's memory for the case number

Re-acquire the SSD to create a new E01 file with the correct metadata

Document the incorrect metadata in the case notes and continue using the E01 file as-is

Edit the E01 metadata using a hex editor and recompute the hash

An examiner receives an evidence file with a .dd extension. The examiner's forensic tool does not recognize the file as a valid image. The examiner suspects the file may actually be an E01 file that was renamed. Which action is most appropriate to determine the true format?

Inspect the file's header bytes to identify the container format signature

Open the file in a hex editor and search for the string 'E01'

Rename the file to .E01 and try to open it in the forensic tool

Compute the file's hash and compare it to the original acquisition hash

Which information is essential to include in the documentation of an evidence file?

The file's hash value and the date/time of acquisition

The file's author and software version

The file's size and extension only

The file's color depth and resolution

GIAC Battlefield Forensics and Acquisition

Domain 5Objective 2

Working with Evidence Files GBFA Practice Questions (Page 7)

Part of the Network and Evidence Handling domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 31–35

31expert · hard
A forensic lab receives a set of evidence files on an encrypted USB drive. The courier provides the password in a separate email. The lab manager wants to ensure the evidence is handled properly while maintaining chain of custody. Which procedure is most appropriate?
Select an answer first
32application · medium
A forensic examiner creates an E01 evidence file from a suspect's SSD. The examiner then transfers the E01 file to a lab server via an encrypted channel. Later, the examiner opens the E01 file in the lab and notices that the case number embedded in the E01 metadata is incorrect. What is the most appropriate action to maintain proper evidence handling and documentation?
Select an answer first
33foundation · easy
Which evidence file format is a container that can store multiple digital artifacts along with metadata and is commonly used by forensic tools to preserve a full disk image?
Select an answer first
34expert · hard
An examiner receives an evidence file with a .dd extension. The examiner's forensic tool does not recognize the file as a valid image. The examiner suspects the file may actually be an E01 file that was renamed. Which action is most appropriate to determine the true format?
Select an answer first
35foundation · easy
Which information is essential to include in the documentation of an evidence file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Working with Evidence Files GBFA Practice Questions (Page 7)

Questions 31–35

A forensic lab receives a set of evidence files on an encrypted USB drive. The courier provides the password in a separate email. The lab manager wants to ensure the evidence is handled properly while maintaining chain of custody. Which procedure is most appropriate?

Which evidence file format is a container that can store multiple digital artifacts along with metadata and is commonly used by forensic tools to preserve a full disk image?

An examiner receives an evidence file with a .dd extension. The examiner's forensic tool does not recognize the file as a valid image. The examiner suspects the file may actually be an E01 file that was renamed. Which action is most appropriate to determine the true format?

Which information is essential to include in the documentation of an evidence file?

Keep studying — Network and Evidence Handling