Introduction to Mobile Forensics GASF Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A forensic examiner is working on a case that involves a smartphone belonging to a foreign national. The device is in the custody of local law enforcement. The examiner needs to extract data that may be stored on servers in another country. Which consideration is most important?

   • AProceed with the extraction because the device is in local custody.
   • BIgnore the foreign data and only extract data stored locally on the device.
   • CDetermine whether the data extraction complies with international data transfer laws.
   • DAsk the foreign national for consent to access the data.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An examiner is analyzing a smartphone that has a custom ROM installed. The device is rooted and has a custom recovery. The examiner wants to extract data without altering the device. Which method is most appropriate?

   • APerform a chip-off extraction to read the flash memory directly.
   • BBoot the device normally and use ADB backup.
   • CUse a forensic tool that exploits a vulnerability in the custom ROM.
   • DUse the custom recovery to create a full image of the data partition.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which ethical obligation is most important for a mobile forensic examiner when handling a case?

   • AMaintaining objectivity and avoiding bias in the examination and reporting.
   • BDeleting irrelevant data to protect the owner's privacy.
   • CMaximizing the amount of data extracted regardless of relevance.
   • DSharing findings with the public to ensure transparency.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A forensic examiner is asked to analyze a smartphone that belongs to a journalist. The device may contain confidential sources. The examiner has a warrant to search the device. Which consideration is most important?

   • AConsider the legal protections for journalists' sources and the potential need for a special court order.
   • BIgnore the journalist's sources and only search for other evidence.
   • CAsk the journalist for consent to search the device.
   • DProceed with the search because the warrant is valid.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which legal principle is most directly relevant when a forensic examiner accesses the contents of a mobile device that belongs to a third party?

   • ACopyright law, which governs the reproduction of software.
   • BContract law, which applies to service agreements.
   • CTrademark law, which protects brand identifiers.
   • DSearch and seizure laws, including warrant requirements and consent.
   Reveal Solution Discussion Select an answer first