A forensic examiner is preparing to transport a seized mobile device to the lab. The device is powered off. Which action is most appropriate to preserve the device's evidence?

Remove the SIM card and store it separately.

Leave the device in a standard evidence bag without any special precautions.

Power the device on to ensure it is functional before transport.

Place the device in a Faraday bag to prevent any wireless communication.

A forensic examiner is documenting the acquisition of a mobile device. The examiner uses a write blocker during the acquisition. Why is this practice important?

It prevents the device from being powered on

It allows the examiner to bypass the device's lock screen

It speeds up the acquisition process

It ensures the device's data is not modified during acquisition

An examiner receives a mobile device that is not labeled. The device powers on and shows a home screen with a grid of icons. To determine the appropriate forensic procedure, which step should the examiner take first?

Remove the back cover to find the model number printed on the battery.

Connect the device to a forensic workstation and run an automated tool.

Check the device's settings menu for the model and OS version.

Perform a physical acquisition immediately to avoid missing evidence.

EC-CouncilComputer Hacking Forensic Investigator

Domain 7Objective 1

Mobile Forensics CHFI Practice Questions (Page 8)

Part of the Mobile and IoT Forensics domain, which makes up ~14% of our current practice bank.

49questions here

10free pages

13concepts

Questions 36–40

36application · medium
A forensic examiner is preparing to transport a seized mobile device to the lab. The device is powered off. Which action is most appropriate to preserve the device's evidence?
Select an answer first
37expert · hard
A forensic examiner is documenting the acquisition of a mobile device. The examiner uses a write blocker during the acquisition. Why is this practice important?
Select an answer first
38foundation · easy
What is the primary file system used by iOS devices?
Select an answer first
39application · medium
An examiner receives a mobile device that is not labeled. The device powers on and shows a home screen with a grid of icons. To determine the appropriate forensic procedure, which step should the examiner take first?
Select an answer first
40foundation · easy
Which mobile data acquisition method captures a bit-for-bit copy of the entire flash memory, including deleted data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.

Mobile Forensics CHFI Practice Questions (Page 8)

Questions 36–40

A forensic examiner is preparing to transport a seized mobile device to the lab. The device is powered off. Which action is most appropriate to preserve the device's evidence?

A forensic examiner is documenting the acquisition of a mobile device. The examiner uses a write blocker during the acquisition. Why is this practice important?

What is the primary file system used by iOS devices?

An examiner receives a mobile device that is not labeled. The device powers on and shows a home screen with a grid of icons. To determine the appropriate forensic procedure, which step should the examiner take first?

Which mobile data acquisition method captures a bit-for-bit copy of the entire flash memory, including deleted data?

Keep studying — Mobile and IoT Forensics