An examiner is asked to extract data from a modern Android smartphone that is encrypted and has no known passcode. The device is powered on but locked. Which approach is most likely to succeed?

Brute-force the passcode using a forensic tool.

Perform a logical extraction using ADB backup.

Perform a physical extraction by connecting to the device's test pins.

Use a commercial forensic tool that exploits a known vulnerability to bypass the lock screen.

A forensic examiner is asked to analyze a personal smartphone belonging to a victim of a crime. The victim has given verbal consent but has not signed a consent form. Which action is most appropriate?

Obtain written consent from the victim before proceeding with the examination.

Proceed with the examination based on verbal consent.

Examine the device without consent because the victim is the complainant.

Ask the victim to sign a consent form after the examination.

Which sequence correctly represents the general forensic process as applied to mobile devices?

Preservation, Identification, Analysis, Acquisition, Reporting

Acquisition, Analysis, Preservation, Identification, Reporting

Identification, Preservation, Acquisition, Analysis, Reporting

Analysis, Acquisition, Preservation, Identification, Reporting

A forensic examiner is asked to analyze a smartphone that belongs to a minor in a school investigation. The school has a policy that allows searching student devices. The examiner must consider legal and ethical implications. What is the most appropriate action?

Ask the minor for permission to search the device.

Proceed with the search based on school policy.

Obtain consent from the minor's parent or guardian before proceeding.

Search the device without consent to protect other students.

GIAC Advanced Smartphone Forensics

Domain 1Objective 1

Introduction to Mobile Forensics GASF Practice Questions (Page 5)

Part of the Mobile Forensics Foundations domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–7 in this domain), expect 5–7 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

5concepts

Questions 21–25

21foundation · easy
Which device type is characterized by a proprietary operating system with limited third-party application support and is often used for basic communication?
Select an answer first
22application · medium
An examiner is asked to extract data from a modern Android smartphone that is encrypted and has no known passcode. The device is powered on but locked. Which approach is most likely to succeed?
Select an answer first
23application · medium
A forensic examiner is asked to analyze a personal smartphone belonging to a victim of a crime. The victim has given verbal consent but has not signed a consent form. Which action is most appropriate?
Select an answer first
24foundation · easy
Which sequence correctly represents the general forensic process as applied to mobile devices?
Select an answer first
25application · medium
A forensic examiner is asked to analyze a smartphone that belongs to a minor in a school investigation. The school has a policy that allows searching student devices. The examiner must consider legal and ethical implications. What is the most appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.