An examiner is investigating a suspected intellectual property theft. The suspect's work computer has been imaged. During analysis, the examiner finds a file that appears to be a confidential company document. What is the next step in the forensic process?

Document the file, its metadata, and its location, and continue the analysis to determine its relevance.

Copy the file to a USB drive and give it to the company's legal team.

Immediately notify law enforcement and provide them with the file.

Delete the file to prevent it from being used as evidence against the company.

A forensic examiner is collecting evidence from a crime scene. The examiner seizes a smartphone that is turned on. What is the best practice for preserving the smartphone's volatile data?

Place the phone in a Faraday bag to isolate it from the network.

Turn the phone off immediately to preserve the battery.

Connect the phone to a charger to ensure it stays on.

Remove the SIM card to prevent communication.

A forensic examiner completes an analysis of a compromised system. The findings will be presented in court. What is the most important aspect of the final report to ensure it is admissible and understandable?

Including raw data dumps and hex dumps of all files examined.

Providing a clear, concise summary of findings, methodology, and conclusions, with supporting evidence and chain of custody documentation.

Including a detailed technical explanation of every tool used and its version number.

Focusing only on the final conclusion and omitting the methodology to avoid confusion.

What is the primary purpose of a forensic report?

To serve as a personal notebook for the examiner's thoughts during the investigation.

To convince the jury that the defendant is guilty.

To document the examiner's findings, methods, and conclusions in a clear and defensible manner.

To provide a detailed technical explanation of every tool used in the analysis.

What is the primary reason forensic examiners create a bit-for-bit image of a storage device before analysis?

To preserve the original evidence in an unaltered state while allowing examination of a copy.

To speed up the analysis process by working on a smaller file.

To reduce the storage space required to keep the evidence.

To convert the data into a format that is readable by all operating systems.

GIAC Certified Forensic Examiner

Domain 1Objective 1

Digital Forensic Fundamentals GCFE Practice Questions (Page 4)

Part of the Digital Forensic Fundamentals domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 16–20

16application · medium
An examiner is investigating a suspected intellectual property theft. The suspect's work computer has been imaged. During analysis, the examiner finds a file that appears to be a confidential company document. What is the next step in the forensic process?
Select an answer first
17application · medium
A forensic examiner is collecting evidence from a crime scene. The examiner seizes a smartphone that is turned on. What is the best practice for preserving the smartphone's volatile data?
Select an answer first
18application · medium
A forensic examiner completes an analysis of a compromised system. The findings will be presented in court. What is the most important aspect of the final report to ensure it is admissible and understandable?
Select an answer first
19foundation · easy
What is the primary purpose of a forensic report?
Select an answer first
20foundation · easy
What is the primary reason forensic examiners create a bit-for-bit image of a storage device before analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.