A forensic image contains an encrypted LUKS partition. What is the first step to access the data without compromising integrity?

Use the dd command to copy the encrypted partition to a new file, then mount the copy.

Use cryptsetup luksOpen to map the encrypted device to a name, then mount the mapped device read-only.

Use the losetup command to associate the encrypted partition with a loop device, then mount it.

Mount the encrypted partition directly with the ro option.

Why is it important to mount a forensic image read-only rather than read-write?

To speed up the mounting process by reducing the number of write operations.

To prevent any changes to the evidence, preserving its integrity for later analysis and legal proceedings.

To ensure that the filesystem is checked for errors before mounting.

To allow multiple analysts to mount the same image simultaneously.

You are mounting a forensic image of a filesystem that has a hardware RAID controller. The image was created by imaging each physical disk separately. You need to reconstruct the logical volume to mount it read-only. Which approach is most appropriate?

Mount each disk image individually and then merge the directories.

Use dmraid to activate the RAID array from the loop devices, then mount the resulting device read-only.

Use mdadm to assemble the RAID array from the loop devices, then mount the resulting md device read-only.

Use lvm2 to combine the disk images into a volume group.

You are documenting the mounting procedure for a forensic image. Which information is essential to record to maintain a clear chain of custody and reproducibility?

The IP address of the forensic workstation and the version of the operating system.

The exact mount command, options used, and the timestamp of the mount.

The file size of the image and the hash value of the image.

The serial number of the hard drive and the name of the analyst.

GIAC Linux Incident Responder

Domain 3Objective 2

Evidence Collection and Mounting GLIR Practice Questions (Page 5)

Part of the Incident Response and Evidence Handling domain, which makes up ~21% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 5–8 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

5concepts

Questions 21–25

21application · medium
You are mounting a forensic image of a filesystem that was originally mounted with the 'noatime' option. You want to ensure that no writes occur during your examination. Which mount option is essential?
Select an answer first
22foundation · easy
A forensic image contains an encrypted LUKS partition. What is the first step to access the data without compromising integrity?
Select an answer first
23foundation · easy
Why is it important to mount a forensic image read-only rather than read-write?
Select an answer first
24expert · hard
You are mounting a forensic image of a filesystem that has a hardware RAID controller. The image was created by imaging each physical disk separately. You need to reconstruct the logical volume to mount it read-only. Which approach is most appropriate?
Select an answer first
25application · medium
You are documenting the mounting procedure for a forensic image. Which information is essential to record to maintain a clear chain of custody and reproducibility?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GLIR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GLIR” is a trademark of its owner, used for identification only.