You are documenting the mounting of a forensic image. You have recorded the command, options, timestamp, and hash values. What else should you include to maintain a complete chain of custody?

The color of the forensic workstation

The weather on the day of the examination

The name and signature of the person who performed the mounting

The brand of the hard drive used to store the image

You have a forensic image of a Linux system that used a software RAID 1 (mirror) with LUKS encryption on the md device. You have both disk images and the passphrase. You need to mount the filesystem read-only. Which sequence of steps is correct?

Use dmraid to assemble the RAID array, then cryptsetup luksOpen, then mount read-only.

Attach both disk images to loop devices, assemble the RAID array with mdadm, then use cryptsetup luksOpen on the md device, then mount the mapper device read-only.

Assemble the RAID array with mdadm, then mount the md device directly read-only without decryption.

Use cryptsetup luksOpen on one disk image directly, then mount the mapper device read-only.

An incident responder needs to mount a forensic image of a Linux filesystem to examine its contents. Which mount command ensures the filesystem is mounted read-only?

mount -t ext4 /dev/sdb1 /mnt/evidence

mount -o ro /dev/sdb1 /mnt/evidence

mount -o rw /dev/sdb1 /mnt/evidence

GIAC Linux Incident Responder

Domain 3Objective 2

Evidence Collection and Mounting GLIR Practice Questions (Page 2)

Part of the Incident Response and Evidence Handling domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

5concepts

Questions 6–10

6application · medium
You are documenting the mounting of a forensic image. You have recorded the command, options, timestamp, and hash values. What else should you include to maintain a complete chain of custody?
Select an answer first
7application · medium
During an incident response, you need to mount a suspect filesystem to extract log files. The filesystem contains a partition that was previously mounted read-write. You want to avoid any changes to file access times and ensure no writes occur. Which set of mount options best achieves this?
Select an answer first
8expert · hard
You have a forensic image of a Linux system that used a software RAID 1 (mirror) with LUKS encryption on the md device. You have both disk images and the passphrase. You need to mount the filesystem read-only. Which sequence of steps is correct?
Select an answer first
9foundation · easy
Which mount option prevents the filesystem from updating access timestamps when files are read, thereby preserving metadata during evidence collection?
Select an answer first
10foundation · easy
An incident responder needs to mount a forensic image of a Linux filesystem to examine its contents. Which mount command ensures the filesystem is mounted read-only?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.

Evidence Collection and Mounting GLIR Practice Questions (Page 2)

Questions 6–10

You are documenting the mounting of a forensic image. You have recorded the command, options, timestamp, and hash values. What else should you include to maintain a complete chain of custody?

During an incident response, you need to mount a suspect filesystem to extract log files. The filesystem contains a partition that was previously mounted read-write. You want to avoid any changes to file access times and ensure no writes occur. Which set of mount options best achieves this?

You have a forensic image of a Linux system that used a software RAID 1 (mirror) with LUKS encryption on the md device. You have both disk images and the passphrase. You need to mount the filesystem read-only. Which sequence of steps is correct?

Which mount option prevents the filesystem from updating access timestamps when files are read, thereby preserving metadata during evidence collection?

An incident responder needs to mount a forensic image of a Linux filesystem to examine its contents. Which mount command ensures the filesystem is mounted read-only?

Keep studying — Incident Response and Evidence Handling