An examiner is investigating a case involving a smartphone that is connected to a cellular network. The examiner wants to prevent the device from receiving new data or being remotely wiped. Which action should the examiner take?

Turn off the device and remove the SIM card.

Connect the device to a Wi-Fi network to stabilize it.

Place the device in a Faraday bag or enable airplane mode.

Leave the device powered on and connected to the network.

An examiner is investigating a smartphone that is water-damaged and will not power on. The device is a high-end Android model with encrypted storage. The examiner needs to recover data. Which approach is most likely to be successful?

Use JTAG to interface with the device's test points.

Attempt a logical extraction after repairing the device.

Perform a chip-off acquisition to read the flash memory directly.

Place the device in rice to dry it and then attempt normal boot.

A forensic examiner is asked to analyze a smartphone that is part of a corporate investigation. The device is company-issued but the employee has used it for personal activities. The company policy states that all data on company devices is the company's property. The employee has refused to provide the passcode. Which approach best balances legal and ethical considerations?

Ask the employee to sign a consent form to allow the examination.

Obtain a court order to compel the employee to provide the passcode.

Use a forensic tool to bypass the passcode and extract all data, including personal data.

Examine only the corporate data and ignore personal data.

A forensic examiner is working on a case that involves a smartphone belonging to a minor. The parents have given consent for the examination. Which additional consideration is most important?

Proceed with the examination because parental consent is sufficient.

Ensure that the consent is within the legal scope for minors in the jurisdiction.

Examine the device without consent because the minor is not the suspect.

Ask the minor for consent instead of the parents.

An examiner is asked to analyze a feature phone that does not have a smartphone operating system. The phone is powered on and shows a menu. Which extraction method is most appropriate?

Perform a chip-off extraction to read the flash memory directly.

Use a generic smartphone forensic tool that supports Android and iOS.

Use a forensic tool that supports the specific make and model of the feature phone.

Use a JTAG method to access the phone's memory.

GIAC Advanced Smartphone Forensics

Domain 1Objective 1

Introduction to Mobile Forensics GASF Practice Questions (Page 3)

Part of the Mobile Forensics Foundations domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–7 in this domain), expect 5–7 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

5concepts

Questions 11–15

11application · medium
An examiner is investigating a case involving a smartphone that is connected to a cellular network. The examiner wants to prevent the device from receiving new data or being remotely wiped. Which action should the examiner take?
Select an answer first
12expert · hard
An examiner is investigating a smartphone that is water-damaged and will not power on. The device is a high-end Android model with encrypted storage. The examiner needs to recover data. Which approach is most likely to be successful?
Select an answer first
13expert · hard
A forensic examiner is asked to analyze a smartphone that is part of a corporate investigation. The device is company-issued but the employee has used it for personal activities. The company policy states that all data on company devices is the company's property. The employee has refused to provide the passcode. Which approach best balances legal and ethical considerations?
Select an answer first
14application · medium
A forensic examiner is working on a case that involves a smartphone belonging to a minor. The parents have given consent for the examination. Which additional consideration is most important?
Select an answer first
15application · medium
An examiner is asked to analyze a feature phone that does not have a smartphone operating system. The phone is powered on and shows a menu. Which extraction method is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.