A forensic examiner creates a raw image of a mobile phone's internal storage using a hardware tool. The examiner then stores the image on a network share and later transfers it to an external drive for analysis. Which documentation is essential to maintain a proper chain of custody?

An email to the case supervisor stating that the image was created

A list of the tools used to create the image, without any dates or names

A screenshot of the image file's properties showing its size and creation date

A log that records each transfer of the image, including date, time, and the person responsible

An examiner must acquire a 4 TB hard drive that is currently in use by a running server. The server cannot be shut down for more than 15 minutes. The examiner needs to preserve the drive's contents as accurately as possible. Which acquisition strategy best balances accuracy and the time constraint?

Use a network-based acquisition tool to image the drive over the network

Shut down the server and perform a dead acquisition within the 15-minute window

Copy only the active files to an external drive and hash them

Perform a live acquisition using a forensic tool that captures the drive while the server is running, then document the fact that the system was live

An examiner needs to acquire a forensic image of a laptop's hard drive. The laptop is running and the examiner wants to avoid any changes to the drive. What is the correct procedure?

Boot the laptop from a trusted forensic live CD and use a hardware write-blocker to connect the drive to an external imaging station.

Use the laptop's built-in backup utility to create a system image to an external drive.

Power off the laptop and then use a USB adapter to connect the drive to a workstation for imaging.

Remove the hard drive and connect it directly to a forensic workstation without a write-blocker, then image it.

An examiner has created a raw DD image of a suspect's drive. To verify the integrity of the image after creation, the examiner should compute which hash and compare it to what?

Compute the MD5 hash of the original drive and compare it to the MD5 hash of the image file.

Compute the SHA-256 hash of the image file and compare it to the hash of the original drive's boot sector.

Compute the CRC32 checksum of the image file and compare it to the CRC32 of the original drive's file system.

Compute the SHA-1 hash of the image file and compare it to the hash of the original drive's partition table.

GIAC Battlefield Forensics and Acquisition

Domain 5Objective 2

Working with Evidence Files GBFA Practice Questions (Page 8)

Part of the Network and Evidence Handling domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 36–40

36application · medium
A forensic examiner creates a raw image of a mobile phone's internal storage using a hardware tool. The examiner then stores the image on a network share and later transfers it to an external drive for analysis. Which documentation is essential to maintain a proper chain of custody?
Select an answer first
37expert · hard
An examiner must acquire a 4 TB hard drive that is currently in use by a running server. The server cannot be shut down for more than 15 minutes. The examiner needs to preserve the drive's contents as accurately as possible. Which acquisition strategy best balances accuracy and the time constraint?
Select an answer first
38foundation · easy
Which tool is commonly used to acquire a bit-for-bit image of a storage device in a forensic investigation?
Select an answer first
39application · medium
An examiner needs to acquire a forensic image of a laptop's hard drive. The laptop is running and the examiner wants to avoid any changes to the drive. What is the correct procedure?
Select an answer first
40application · medium
An examiner has created a raw DD image of a suspect's drive. To verify the integrity of the image after creation, the examiner should compute which hash and compare it to what?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.