An examiner has a raw image of a USB drive and needs to find a specific deleted document. The file system metadata is intact. Which analysis technique is most efficient for locating the deleted document?

Perform a full file carving scan across the entire image

Search the image for the file's signature using a hex editor

Parse the file system metadata to identify the deleted file's entry and recover its data

Mount the image and use the operating system's recycle bin to find the file

When transporting physical evidence containing digital files, which procedure is most appropriate?

Carry the evidence in a regular plastic bag without documentation

Leave the evidence unsealed to allow easy access

Store the evidence in a metal container without any labeling

Seal the evidence in an anti-static bag and maintain a chain of custody log

A forensic examiner must acquire the contents of a USB drive that contains a mix of deleted files and unallocated space. The examiner wants a single evidence file that preserves the entire device, including deleted data, and supports later verification of integrity. Which acquisition approach best meets these requirements?

Copy only the visible files from the USB to a folder and hash each file individually

Use a write blocker and then run a file recovery tool to extract deleted files

Create a raw (DD) image of the entire USB device and compute a SHA-256 hash of the image

Create a logical image of the file system that excludes unallocated space

A forensic examiner is about to analyze an evidence file that was acquired six months ago. The examiner verifies the SHA-256 hash and it matches the original acquisition hash. However, the examiner notices that the file's last modified timestamp is recent. What is the most appropriate conclusion?

The file's content is unchanged, but the timestamp may have been updated by copying or moving the file

The examiner should re-acquire the evidence because the timestamp is suspicious

The hash is invalid because the timestamp changed

The file has been tampered with because the timestamp is recent

GIAC Battlefield Forensics and Acquisition

Domain 5Objective 2

Working with Evidence Files GBFA Practice Questions (Page 9)

Part of the Network and Evidence Handling domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

6concepts

Questions 41–44

41application · medium
An examiner has a raw image of a USB drive and needs to find a specific deleted document. The file system metadata is intact. Which analysis technique is most efficient for locating the deleted document?
Select an answer first
42foundation · easy
When transporting physical evidence containing digital files, which procedure is most appropriate?
Select an answer first
43application · medium
A forensic examiner must acquire the contents of a USB drive that contains a mix of deleted files and unallocated space. The examiner wants a single evidence file that preserves the entire device, including deleted data, and supports later verification of integrity. Which acquisition approach best meets these requirements?
Select an answer first
44expert · hard
A forensic examiner is about to analyze an evidence file that was acquired six months ago. The examiner verifies the SHA-256 hash and it matches the original acquisition hash. However, the examiner notices that the file's last modified timestamp is recent. What is the most appropriate conclusion?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Working with Evidence Files GBFA Practice Questions (Page 9)

Questions 41–44

An examiner has a raw image of a USB drive and needs to find a specific deleted document. The file system metadata is intact. Which analysis technique is most efficient for locating the deleted document?

When transporting physical evidence containing digital files, which procedure is most appropriate?

A forensic examiner is about to analyze an evidence file that was acquired six months ago. The examiner verifies the SHA-256 hash and it matches the original acquisition hash. However, the examiner notices that the file's last modified timestamp is recent. What is the most appropriate conclusion?

Keep studying — Network and Evidence Handling