A forensic examiner receives an Android smartphone that is powered on and locked with a PIN. The device is not rooted, and USB debugging is disabled. The examiner needs to acquire a logical image of the device's user data. What is the most appropriate acquisition method?

Obtain the PIN from the user and then use a logical acquisition tool to extract data via USB

Use Android Debug Bridge (ADB) backup to extract app data after enabling USB debugging

Perform a physical acquisition using a commercial tool like Cellebrite UFED

Boot the device into recovery mode and use adb to pull a full image

A forensic examiner is acquiring a laptop that is currently running Windows 10. The examiner wants to preserve the most volatile data first. Which order of acquisition is most appropriate?

Collect network connections, then capture RAM, then acquire the hard drive.

Capture RAM, then collect network connections, then acquire the hard drive.

Capture RAM, then acquire the hard drive, then collect network connections.

Acquire the hard drive first, then capture RAM, then collect network connections.

What is the primary purpose of timeline analysis in digital forensics?

To compare file hashes to known malware signatures

To identify the owner of a device based on user accounts

To determine the physical location of a device at a specific time

To reconstruct the sequence of events and user actions on a system over time

In file system forensics, what does the Master File Table (MFT) in NTFS primarily contain?

Metadata about every file and directory on the volume, including timestamps and file attributes

The actual content of every file stored on the volume

A list of all deleted files that can be recovered from the unallocated space

The encryption keys used to protect files on the volume

An examiner is investigating a case where a suspect used a secure-deletion tool to overwrite a specific file's clusters on an NTFS drive. The examiner needs to recover the file's content. Which approach is most likely to succeed?

Perform file carving on the unallocated space.

Check the Volume Shadow Copies for a previous version.

Use the Recycle Bin to recover the file.

Examine the MFT entry for the file to see if the data runs are still present.

GIAC Certified Forensic Examiner

Domain 4Objective 1

System and Device Analysis GCFE Practice Questions (Page 6)

Part of the System and Device Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 26–30

26application · medium
A forensic examiner receives an Android smartphone that is powered on and locked with a PIN. The device is not rooted, and USB debugging is disabled. The examiner needs to acquire a logical image of the device's user data. What is the most appropriate acquisition method?
Select an answer first
27application · medium
A forensic examiner is acquiring a laptop that is currently running Windows 10. The examiner wants to preserve the most volatile data first. Which order of acquisition is most appropriate?
Select an answer first
28foundation · easy
What is the primary purpose of timeline analysis in digital forensics?
Select an answer first
29foundation · easy
In file system forensics, what does the Master File Table (MFT) in NTFS primarily contain?
Select an answer first
30expert · hard
An examiner is investigating a case where a suspect used a secure-deletion tool to overwrite a specific file's clusters on an NTFS drive. The examiner needs to recover the file's content. Which approach is most likely to succeed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.