A forensic examiner is preparing a report for a case that will be presented in court. The report includes findings from a mobile device analysis. The examiner used a commercial forensic tool. What is the most important information to include in the report?

A detailed explanation of the analysis methodology, including the steps taken and the rationale for each step.

The examiner's personal opinion on the guilt or innocence of the suspect.

A list of all files found on the device, including their metadata.

The version of the forensic tool and the date of the analysis.

A forensic examiner is investigating a case involving a company-owned laptop. The employee's personal files are found on the laptop. The employee claims privacy over these files. The company's policy states that employees have no expectation of privacy on company devices. What is the most appropriate action for the examiner?

Stop the examination and seek a warrant before proceeding.

Ignore the personal files and only examine work-related files to respect the employee's privacy.

Examine the personal files and document their relevance to the case, while noting the company policy in the report.

Return the laptop to the employee and request a court order before proceeding.

When collecting a computer as evidence, what is the proper first step to preserve the digital evidence?

Turn the computer on and browse the files to see if there is anything relevant.

Photograph the scene and then disconnect the power without letting the system shut down normally.

Copy all files to a USB drive and then seize the computer.

Run a virus scan to ensure the system is safe to handle.

A mid-sized company wants to improve its ability to respond to future security incidents without disrupting daily operations. The legal team requires that any evidence collected be admissible in court. Which forensic-readiness measure should the company implement FIRST?

Create a chain-of-custody form template.

Deploy endpoint logging and centralized log collection for key systems.

Train all employees on incident response procedures.

Purchase forensic imaging software for the IT team.

A forensic examiner is called to image a laptop involved in a data-exfiltration incident. The laptop is still running and the user's session is active. The examiner wants to preserve the most volatile data first while maintaining a defensible chain of custody. Which action should the examiner take first?

Copy the hard drive using a write-blocker before touching RAM.

Log the user's active processes to a notepad for documentation.

Capture a live image of RAM using a trusted forensic tool.

Pull the power cord immediately to freeze the system state.

GIAC Certified Forensic Examiner

Domain 1Objective 1

Digital Forensic Fundamentals GCFE Practice Questions (Page 5)

Part of the Digital Forensic Fundamentals domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 7–12 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 21–25

21expert · hard
A forensic examiner is preparing a report for a case that will be presented in court. The report includes findings from a mobile device analysis. The examiner used a commercial forensic tool. What is the most important information to include in the report?
Select an answer first
22application · medium
A forensic examiner is investigating a case involving a company-owned laptop. The employee's personal files are found on the laptop. The employee claims privacy over these files. The company's policy states that employees have no expectation of privacy on company devices. What is the most appropriate action for the examiner?
Select an answer first
23foundation · easy
When collecting a computer as evidence, what is the proper first step to preserve the digital evidence?
Select an answer first
24application · medium
A mid-sized company wants to improve its ability to respond to future security incidents without disrupting daily operations. The legal team requires that any evidence collected be admissible in court. Which forensic-readiness measure should the company implement FIRST?
Select an answer first
25application · medium
A forensic examiner is called to image a laptop involved in a data-exfiltration incident. The laptop is still running and the user's session is active. The examiner wants to preserve the most volatile data first while maintaining a defensible chain of custody. Which action should the examiner take first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Digital Forensic Fundamentals GCFE Practice Questions (Page 5)

Questions 21–25

A forensic examiner is preparing a report for a case that will be presented in court. The report includes findings from a mobile device analysis. The examiner used a commercial forensic tool. What is the most important information to include in the report?

When collecting a computer as evidence, what is the proper first step to preserve the digital evidence?

A mid-sized company wants to improve its ability to respond to future security incidents without disrupting daily operations. The legal team requires that any evidence collected be admissible in court. Which forensic-readiness measure should the company implement FIRST?

Keep studying — Digital Forensic Fundamentals