A forensic examiner is collecting evidence from a crime scene. The examiner finds a USB drive on the suspect's desk. What is the most appropriate way to handle this evidence?

Place the USB drive in an anti-static bag, seal it in an evidence bag, and document its location and condition.

Label the USB drive with a permanent marker and place it in a regular envelope.

Copy the contents of the USB drive to a CD and then dispose of the original.

Plug the USB drive into the examiner's laptop to quickly view its contents.

A company wants to improve its forensic readiness but has a limited budget. The company cannot afford expensive forensic tools or dedicated forensic staff. Which measure provides the most value for the budget?

Implement centralized logging and retain logs for a defined period.

Hire a full-time forensic examiner.

Purchase a commercial forensic imaging tool.

Create a forensic lab with specialized equipment.

An examiner is investigating a case where the suspect's computer was found turned off. The examiner needs to determine when the computer was last used. What is the most appropriate source of evidence to answer this question?

The computer's power supply, which may indicate when it was last turned on.

The computer's RAM, which may contain recent activity.

The computer's file system metadata, such as last accessed times.

The computer's network logs, which show when it was connected.

Which of the following is a key component of forensic readiness?

Establishing a documented incident response plan that includes evidence preservation steps.

Ensuring that all employees have administrative access to systems.

Avoiding the use of encryption to simplify data access.

Deleting logs regularly to reduce storage costs.

A forensic examiner is writing a report for a case involving alleged intellectual property theft. The report will be read by both the company's non-technical executives and the legal team. Which approach is most appropriate for the report?

Write the report using highly technical language to demonstrate expertise.

Provide a clear executive summary followed by detailed technical findings with supporting evidence.

Use vague language to avoid committing to specific findings.

Include only the final conclusion to avoid overwhelming readers.

GIAC Certified Forensic Examiner

Domain 1Objective 1

Digital Forensic Fundamentals GCFE Practice Questions (Page 3)

Part of the Digital Forensic Fundamentals domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 11–15

11application · medium
A forensic examiner is collecting evidence from a crime scene. The examiner finds a USB drive on the suspect's desk. What is the most appropriate way to handle this evidence?
Select an answer first
12expert · hard
A company wants to improve its forensic readiness but has a limited budget. The company cannot afford expensive forensic tools or dedicated forensic staff. Which measure provides the most value for the budget?
Select an answer first
13expert · hard
An examiner is investigating a case where the suspect's computer was found turned off. The examiner needs to determine when the computer was last used. What is the most appropriate source of evidence to answer this question?
Select an answer first
14foundation · easy
Which of the following is a key component of forensic readiness?
Select an answer first
15application · medium
A forensic examiner is writing a report for a case involving alleged intellectual property theft. The report will be read by both the company's non-technical executives and the legal team. Which approach is most appropriate for the report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.