A forensic examiner is investigating a case involving a smartphone that is connected to a corporate network. The device is suspected of containing evidence of a data breach. The examiner needs to preserve the device state while also ensuring that the investigation does not disrupt the corporate network. Which action is most appropriate?

Power off the device and remove the battery.

Perform a live acquisition while the device is connected to the network.

Isolate the device by placing it in a Faraday bag and then perform a logical extraction.

Connect the device to a forensic workstation and perform a physical extraction.

Which factor is a common challenge in mobile forensics due to the diversity of devices?

Mobile devices always have uniform data storage formats.

Mobile devices do not contain volatile data.

All mobile devices use the same acquisition method.

The wide variety of operating systems, hardware, and file systems complicates tool compatibility.

GIAC Advanced Smartphone Forensics

Domain 1Objective 1

Introduction to Mobile Forensics GASF Practice Questions (Page 7)

Part of the Mobile Forensics Foundations domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–7 in this domain), expect 5–7 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

5concepts

Questions 31–32

31expert · hard
A forensic examiner is investigating a case involving a smartphone that is connected to a corporate network. The device is suspected of containing evidence of a data breach. The examiner needs to preserve the device state while also ensuring that the investigation does not disrupt the corporate network. Which action is most appropriate?
Select an answer first
32foundation · easy
Which factor is a common challenge in mobile forensics due to the diversity of devices?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GASF

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASF” is a trademark of its owner, used for identification only.

Introduction to Mobile Forensics GASF Practice Questions (Page 7)

Questions 31–32

Which factor is a common challenge in mobile forensics due to the diversity of devices?

Keep studying — Mobile Forensics Foundations