Introduction to Mobile Forensics GASF Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A forensic examiner is asked to analyze a smartphone belonging to a victim of a cyberstalking case. The victim has provided consent and the device is unlocked. However, the device contains personal messages and photos unrelated to the case. The examiner must balance thorough investigation with privacy concerns. What is the most appropriate course of action?

   • AExtract all data and review everything for potential evidence.
   • BAsk the victim to delete unrelated messages before extraction.
   • CPerform a full extraction but only report findings directly related to the case.
   • DLimit the extraction to data relevant to the cyberstalking case and document the scope.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A law enforcement officer seizes a smartphone at a search warrant location. The officer needs to ensure the evidence is admissible in court. Which action is most important during the seizure?

   • AImmediately power off the device to prevent remote wiping.
   • BDocument the device's condition, including screen state and any visible notifications.
   • CConnect the device to a forensic workstation at the scene.
   • DPlace the device in a Faraday bag without documenting anything.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which activity falls within the scope of mobile forensics?

   • AInstalling a mobile application to manage device storage and optimize performance.
   • BErasing all data from a mobile device before selling it to protect the previous owner's privacy.
   • CConnecting a mobile device to a computer to transfer photos for personal archiving.
   • DExtracting call logs and text messages from a smartphone using a forensic tool and documenting the process.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A forensic examiner is documenting the steps taken during a mobile device examination. The examiner wants to ensure that the documentation is sufficient for a court to understand the process. Which documentation practice is most important?

   • ARecord the examiner's personal notes and opinions.
   • BRecord only the final results of the examination.
   • CRecord the time spent on the examination.
   • DRecord the exact commands used and the tool version.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which statement best defines the scope of mobile forensics within digital forensics?

   • AThe process of recovering and analyzing data from mobile devices using forensically sound methods to support legal or investigative proceedings.
   • BThe process of unlocking mobile devices to access user data for any purpose, including personal data recovery.
   • CThe backup and synchronization of mobile device data to cloud storage for long-term preservation.
   • DThe analysis of mobile device hardware components to determine the manufacturer and model.
   Reveal Solution Discussion Select an answer first