GIAC CERTIFIED FORENSIC EXAMINER (GCFE) CERTIFICATION | VERIFIED
EXAM QUESTIONS AND ANSWERS - LATEST VERSION 2026/2027
GIAC CERTIFIED FORENSIC EXAMINER (GCFE)
Q: What are the four phases of a digital forensic investigation?
ANSWER Identification, Preservation, Analysis, and Reporting.
Q: What is the order of volatility?
ANSWER CPU registers/cache, RAM, Network state, Running processes,
Disk data, Remote logging, Physical configuration.
Q: Why is capturing volatile data important?
ANSWER Because it is lost when a system is powered off.
Q: What is a write blocker?
ANSWER A hardware or software tool that prevents data from being
written to the evidence drive during acquisition.
Q: What is the difference between a hardware and software write
blocker?
ANSWER Hardware write blockers are physical devices placed between
the drive and the acquisition machine; software write blockers are OS-
level drivers. Hardware is preferred for court.
Q: What is a forensic hash?
ANSWER A mathematical algorithm (like MD5 or SHA-256) used to
verify data integrity and ensure no changes were made to the evidence.
,Q: Which hash algorithm is considered insecure for forensic verification
but still widely used?
ANSWER MD5 (due to collision vulnerabilities), though SHA-1 is also
deprecated. SHA-256 is the current standard.
Q: What is chain of custody?
ANSWER A documented paper trail showing the seizure, custody,
control, transfer, analysis, and disposition of physical and digital evidence.
Q: What is an E01 file?
ANSWER A proprietary forensic image format created by EnCase that
stores the disk image, hash values, and case metadata.
Q: What is a RAW (DD) image?
ANSWER A bit-for-bit copy of a drive with no additional metadata or
compression.
Q: What is the primary tool used by SANS for data acquisition?
ANSWER FTK Imager.
Q: What command creates a RAW image in Linux?
ANSWER dd if=/dev/sda of=/evidence/image.dd bs=4M
conv=noerror,sync
Q: What does conv=noerror,sync do in the dd command?
ANSWER noerror continues reading after a bad block; sync pads bad
blocks with null bytes to maintain image alignment.
Q: What is a bitwise copy?
ANSWER An exact, sector-by-sector clone of a drive, including
unallocated space and file slack.
Q: What is a logical acquisition?
ANSWER Capturing only specific files and folders, rather than the entire
physical disk.
Q: When is a logical acquisition preferred?
ANSWER When time is limited, or when dealing with massive storage
arrays where a full physical image is impractical.
,Q: What is an AFF4 file?
ANSWER An open-source forensic image format that supports
compression, encryption, and multi-image spanning.
Q: What is the purpose of a forensic preview?
ANSWER To quickly assess the relevance of evidence (usually logical) to
determine if a full physical acquisition is warranted.
Q: What is the difference between an affidavit and a search warrant?
ANSWER A warrant is a court order authorizing a search; an affidavit is
the sworn written statement of facts supporting the request for the
warrant.
Q: Who signs an affidavit?
ANSWER The affiant (usually the lead investigator or forensic examiner).
Q: What is spoliation of evidence?
ANSWER The intentional, reckless, or accidental destruction or alteration
of evidence.
Q: What is a "freshness" objection in forensic reporting?
ANSWER A legal challenge arguing that the forensic tool or methodology
used is outdated or no longer scientifically valid.
Q: What does Daubert standard refer to?
ANSWER A legal standard for admitting expert testimony, requiring the
methodology to be tested, peer-reviewed, have a known error rate, and be
generally accepted.
Q: What is the Frye standard?
ANSWER An older legal standard requiring the scientific technique to be
"generally accepted" by the relevant scientific community.
Q: What is hashing collision?
ANSWER When two different files produce the exact same hash value.
Q: How do you verify an acquired image?
ANSWER By comparing the hash (MD5/SHA-256) of the source drive to
the hash of the acquired image file.
, Q: What is a targeted acquisition?
ANSWER Collecting specific data relevant to an investigation (e.g.,
specific registry hives, log files) rather than a full disk image.
Q: What is live response?
ANSWER Collecting volatile data and selected non-volatile data from a
running system without shutting it down.
Q: What tool is commonly used for live response in Windows?
ANSWER KAPE (Kroll Artifact Parser and Extractor) or FTK Imager (for
RAM).
Q: What is a sterile forensic examination environment?
ANSWER A completely wiped, forensically sanitized workstation used to
process evidence to prevent cross-contamination.
Q: Why should you never boot an evidence drive?
ANSWER Booting alters timestamps, changes cache, and may overwrite
evidence in unallocated space.
Q: What is a clone vs. an image?
ANSWER A clone is written directly to another physical drive; an image
is written to a file (like E01 or DD).
Q: What is a "screen shot" limitation in forensics?
ANSWER Screen shots are easily forged, do not capture metadata, and
are not accepted as primary forensic evidence.
Q: What does "proportionality" mean in eDiscovery?
ANSWER The cost and burden of discovery must be proportional to the
value of the case.
Q: What is a forensic workstation?
ANSWER A highly powered computer with specialized hardware (write
blockers, dual drives) and software used for analysis.
Q: What is a "suspect" file?
ANSWER A file flagged during analysis that may contain contraband,
malware, or relevant evidence.
EXAM QUESTIONS AND ANSWERS - LATEST VERSION 2026/2027
GIAC CERTIFIED FORENSIC EXAMINER (GCFE)
Q: What are the four phases of a digital forensic investigation?
ANSWER Identification, Preservation, Analysis, and Reporting.
Q: What is the order of volatility?
ANSWER CPU registers/cache, RAM, Network state, Running processes,
Disk data, Remote logging, Physical configuration.
Q: Why is capturing volatile data important?
ANSWER Because it is lost when a system is powered off.
Q: What is a write blocker?
ANSWER A hardware or software tool that prevents data from being
written to the evidence drive during acquisition.
Q: What is the difference between a hardware and software write
blocker?
ANSWER Hardware write blockers are physical devices placed between
the drive and the acquisition machine; software write blockers are OS-
level drivers. Hardware is preferred for court.
Q: What is a forensic hash?
ANSWER A mathematical algorithm (like MD5 or SHA-256) used to
verify data integrity and ensure no changes were made to the evidence.
,Q: Which hash algorithm is considered insecure for forensic verification
but still widely used?
ANSWER MD5 (due to collision vulnerabilities), though SHA-1 is also
deprecated. SHA-256 is the current standard.
Q: What is chain of custody?
ANSWER A documented paper trail showing the seizure, custody,
control, transfer, analysis, and disposition of physical and digital evidence.
Q: What is an E01 file?
ANSWER A proprietary forensic image format created by EnCase that
stores the disk image, hash values, and case metadata.
Q: What is a RAW (DD) image?
ANSWER A bit-for-bit copy of a drive with no additional metadata or
compression.
Q: What is the primary tool used by SANS for data acquisition?
ANSWER FTK Imager.
Q: What command creates a RAW image in Linux?
ANSWER dd if=/dev/sda of=/evidence/image.dd bs=4M
conv=noerror,sync
Q: What does conv=noerror,sync do in the dd command?
ANSWER noerror continues reading after a bad block; sync pads bad
blocks with null bytes to maintain image alignment.
Q: What is a bitwise copy?
ANSWER An exact, sector-by-sector clone of a drive, including
unallocated space and file slack.
Q: What is a logical acquisition?
ANSWER Capturing only specific files and folders, rather than the entire
physical disk.
Q: When is a logical acquisition preferred?
ANSWER When time is limited, or when dealing with massive storage
arrays where a full physical image is impractical.
,Q: What is an AFF4 file?
ANSWER An open-source forensic image format that supports
compression, encryption, and multi-image spanning.
Q: What is the purpose of a forensic preview?
ANSWER To quickly assess the relevance of evidence (usually logical) to
determine if a full physical acquisition is warranted.
Q: What is the difference between an affidavit and a search warrant?
ANSWER A warrant is a court order authorizing a search; an affidavit is
the sworn written statement of facts supporting the request for the
warrant.
Q: Who signs an affidavit?
ANSWER The affiant (usually the lead investigator or forensic examiner).
Q: What is spoliation of evidence?
ANSWER The intentional, reckless, or accidental destruction or alteration
of evidence.
Q: What is a "freshness" objection in forensic reporting?
ANSWER A legal challenge arguing that the forensic tool or methodology
used is outdated or no longer scientifically valid.
Q: What does Daubert standard refer to?
ANSWER A legal standard for admitting expert testimony, requiring the
methodology to be tested, peer-reviewed, have a known error rate, and be
generally accepted.
Q: What is the Frye standard?
ANSWER An older legal standard requiring the scientific technique to be
"generally accepted" by the relevant scientific community.
Q: What is hashing collision?
ANSWER When two different files produce the exact same hash value.
Q: How do you verify an acquired image?
ANSWER By comparing the hash (MD5/SHA-256) of the source drive to
the hash of the acquired image file.
, Q: What is a targeted acquisition?
ANSWER Collecting specific data relevant to an investigation (e.g.,
specific registry hives, log files) rather than a full disk image.
Q: What is live response?
ANSWER Collecting volatile data and selected non-volatile data from a
running system without shutting it down.
Q: What tool is commonly used for live response in Windows?
ANSWER KAPE (Kroll Artifact Parser and Extractor) or FTK Imager (for
RAM).
Q: What is a sterile forensic examination environment?
ANSWER A completely wiped, forensically sanitized workstation used to
process evidence to prevent cross-contamination.
Q: Why should you never boot an evidence drive?
ANSWER Booting alters timestamps, changes cache, and may overwrite
evidence in unallocated space.
Q: What is a clone vs. an image?
ANSWER A clone is written directly to another physical drive; an image
is written to a file (like E01 or DD).
Q: What is a "screen shot" limitation in forensics?
ANSWER Screen shots are easily forged, do not capture metadata, and
are not accepted as primary forensic evidence.
Q: What does "proportionality" mean in eDiscovery?
ANSWER The cost and burden of discovery must be proportional to the
value of the case.
Q: What is a forensic workstation?
ANSWER A highly powered computer with specialized hardware (write
blockers, dual drives) and software used for analysis.
Q: What is a "suspect" file?
ANSWER A file flagged during analysis that may contain contraband,
malware, or relevant evidence.
