An incident response team needs to acquire a forensic image of a laptop's hard drive. The laptop is powered off and the drive is removed. Which tool or method should be used to create a bit-for-bit image while ensuring the original drive is not altered?

Boot the laptop from a forensic CD and use the built-in copy command to duplicate the drive.

Place the drive in an anti-static bag and send it to a lab without imaging.

Connect the drive to a forensic workstation using a write-blocker and use imaging software to create a raw image.

Use a USB-to-SATA adapter to connect the drive to a workstation and drag-and-drop the files to a new drive.

When collecting a piece of digital evidence, what should be documented immediately?

The date, time, location, and the identity of the person collecting the evidence.

The IP address of the network the device was connected to.

The estimated value of the evidence for insurance purposes.

The type of operating system used on the evidence device.

What is a forensic image?

A bit-for-bit copy of a storage medium that includes all data, including deleted files and unallocated space.

A logical copy of only the active files on a storage medium.

A compressed archive of the operating system and installed applications.

A screenshot of the desktop and open applications.

An incident responder arrives at a scene where a laptop is still running and shows signs of active malware. The responder must preserve evidence while following a proper forensic methodology. Which sequence of actions BEST follows the forensic process?

Document the chain of custody, then immediately power off the laptop and remove the hard drive.

Identify the device, capture volatile memory, create a forensic image, document the chain of custody, and analyze the image.

Analyze the live system by running forensic tools on it, then create an image for later analysis.

Create a forensic image first, then capture memory, and finally document the chain of custody.

Which of the following is an example of an anti-forensic technique?

Creating a forensic image of a hard drive.

Using a write-blocker when imaging a drive.

Documenting the chain of custody.

Encrypting files to hide their contents from investigators.

GIAC Certified Enterprise Defender

Domain 2Objective 2

Digital Forensics Concepts and Application GCED Practice Questions (Page 7)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 31–35

31application · medium
An incident response team needs to acquire a forensic image of a laptop's hard drive. The laptop is powered off and the drive is removed. Which tool or method should be used to create a bit-for-bit image while ensuring the original drive is not altered?
Select an answer first
32foundation · easy
When collecting a piece of digital evidence, what should be documented immediately?
Select an answer first
33foundation · easy
What is a forensic image?
Select an answer first
34application · medium
An incident responder arrives at a scene where a laptop is still running and shows signs of active malware. The responder must preserve evidence while following a proper forensic methodology. Which sequence of actions BEST follows the forensic process?
Select an answer first
35foundation · easy
Which of the following is an example of an anti-forensic technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.