Introduction to Mobile Forensics GASF Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A forensic examiner receives a smartphone that was found at a crime scene. The device is powered on and shows a lock screen. The examiner needs to preserve the device state and avoid accidental data modification. Which step should the examiner take first?

   • AConnect the device to a forensic workstation to begin imaging.
   • BPower off the device to prevent further network activity.
   • CPlace the device in a Faraday bag and document the screen contents.
   • DUnlock the device using the victim's passcode provided by law enforcement.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A forensic examiner is asked to analyze a smartwatch that may contain health data relevant to a case. The smartwatch is paired with a smartphone that is also in evidence. Which statement best describes the scope of mobile forensics in this scenario?

   • AMobile forensics only applies to the smartphone because the smartwatch is not a primary communication device.
   • BMobile forensics only applies to the smartwatch because the smartphone is a secondary device.
   • CMobile forensics includes the smartwatch and the smartphone, as both are mobile devices that may contain relevant data.
   • DMobile forensics only applies to smartphones, not wearables.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why is encryption a significant challenge in mobile forensics?

   • AEncryption makes data easier to recover because it is compressed.
   • BEncryption is a legal requirement that simplifies forensic access.
   • CEncryption is only used on older devices and is not a current issue.
   • DEncryption can render data inaccessible without the correct credentials or keys.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A forensic examiner is investigating a case involving a smartphone that is part of a cloud-synced ecosystem. The examiner has extracted data from the device, but some data may only be available in the cloud. Which action is most appropriate?

   • AIgnore the cloud data and only analyze the data extracted from the device.
   • BAsk the cloud provider for the data without a warrant.
   • CObtain a warrant or legal authorization to access the cloud data.
   • DAccess the cloud data using the device's credentials.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An examiner is analyzing a smartphone that has a broken screen and is unresponsive to touch. The device is recognized by the computer when connected via USB. Which extraction method is most appropriate?

   • AUse a JTAG method to access the device's memory.
   • BPerform a chip-off extraction to read the flash memory directly.
   • CAttempt to brute-force the passcode using the broken screen.
   • DUse a USB OTG adapter with a mouse to navigate the device.
   Reveal Solution Discussion Select an answer first