Which characteristic is most relevant to forensic examination of a smartphone compared to a traditional feature phone?

Smartphones run full operating systems with extensive application data and cloud synchronization.

Smartphones do not retain location data.

Feature phones are always more secure than smartphones.

Feature phones have more storage capacity than smartphones.

An examiner is tasked with extracting data from a smartphone that uses full-disk encryption and has a locked bootloader. The device is powered on and the screen is locked. Which approach is most likely to yield forensic data while preserving evidence integrity?

Place the device in a Faraday bag and wait for the battery to drain.

Use a chip-off method to read the flash memory directly.

Perform a logical extraction after unlocking the device with the user's passcode.

Attempt a physical extraction using a bootloader exploit.

A corporate investigator is asked to examine a company-issued smartphone belonging to an employee who is suspected of leaking confidential data. The employee has a personal Google account linked to the device. Which action best balances legal and ethical considerations?

Search the device immediately to prevent further data leakage.

Ask the employee for the passcode and then search the device.

Only search the corporate email app and ignore personal apps.

Review the corporate acceptable-use policy and obtain legal approval before searching the device.

What is the primary purpose of the preservation phase in mobile device forensics?

To document the findings for court presentation.

To interpret the meaning of recovered data.

To extract all possible data from the device.

To prevent any changes to the device's data before and during acquisition.

An examiner is analyzing a smartphone that has a damaged charging port. The device is powered on and has a full battery. The examiner needs to extract data but cannot connect via USB. Which method is most appropriate?

Replace the charging port and then connect via USB.

Use wireless debugging or network-based extraction if the device supports it.

Use a JTAG method to access the device's memory.

Perform a chip-off extraction to read the flash memory directly.

GIAC Advanced Smartphone Forensics

Domain 1Objective 1

Introduction to Mobile Forensics GASF Practice Questions (Page 4)

Part of the Mobile Forensics Foundations domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–7 in this domain), expect 5–7 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

5concepts

Questions 16–20

16foundation · easy
Which characteristic is most relevant to forensic examination of a smartphone compared to a traditional feature phone?
Select an answer first
17application · medium
An examiner is tasked with extracting data from a smartphone that uses full-disk encryption and has a locked bootloader. The device is powered on and the screen is locked. Which approach is most likely to yield forensic data while preserving evidence integrity?
Select an answer first
18application · medium
A corporate investigator is asked to examine a company-issued smartphone belonging to an employee who is suspected of leaking confidential data. The employee has a personal Google account linked to the device. Which action best balances legal and ethical considerations?
Select an answer first
19foundation · easy
What is the primary purpose of the preservation phase in mobile device forensics?
Select an answer first
20expert · hard
An examiner is analyzing a smartphone that has a damaged charging port. The device is powered on and has a full battery. The examiner needs to extract data but cannot connect via USB. Which method is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.