A forensic examiner is about to acquire a mobile device that is evidence in a criminal case. The device is powered on and unlocked. The examiner must ensure the evidence is admissible in court. Which action is most important to take before beginning the acquisition?

Place the device in a Faraday bag to isolate it from the network.

Immediately connect the device to a forensic workstation to begin acquisition.

Power off the device to prevent remote wiping.

Document the device state, including screen contents, and note the date/time and location.

A forensic examiner is called to acquire a mobile device that is part of a corporate investigation. The device is a company-issued phone used by an employee. The employee is suspected of leaking confidential data. The examiner must ensure the acquisition is legally defensible. Which step is most important?

Perform a physical acquisition to ensure all data is captured.

Ask the employee to provide the passcode.

Place the device in a Faraday bag to prevent remote wiping.

Obtain written authorization from the company's legal department or a warrant.

A forensic examiner is preparing to acquire data from a mobile device that is part of a criminal investigation. The device is powered on and unlocked. The examiner needs to ensure that the acquisition is legally permissible and that the evidence will be admissible. Which step is most important to take before beginning the acquisition?

Verify that the device's battery is fully charged.

Obtain a search warrant or legal authorization to search the device.

Document the device's model and serial number.

Place the device in a Faraday bag to prevent remote wiping.

What is the primary reason for extracting application data from a mobile device during an investigation?

To obtain evidence of user activity and communications stored within apps

To recover deleted text messages

To determine the device's battery health

To identify the device's manufacturer

What is the primary reason to place a mobile device in airplane mode or a Faraday bag before acquisition?

To make the device easier to connect to a forensic workstation

To prevent the device from receiving or transmitting data that could alter its state

To preserve battery life during the acquisition

To speed up the acquisition process

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 1

Mobile Device Acquisition GBFA Practice Questions (Page 1)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 1–5

1application · medium
A forensic examiner is about to acquire a mobile device that is evidence in a criminal case. The device is powered on and unlocked. The examiner must ensure the evidence is admissible in court. Which action is most important to take before beginning the acquisition?
Select an answer first
2application · medium
A forensic examiner is called to acquire a mobile device that is part of a corporate investigation. The device is a company-issued phone used by an employee. The employee is suspected of leaking confidential data. The examiner must ensure the acquisition is legally defensible. Which step is most important?
Select an answer first
3application · medium
A forensic examiner is preparing to acquire data from a mobile device that is part of a criminal investigation. The device is powered on and unlocked. The examiner needs to ensure that the acquisition is legally permissible and that the evidence will be admissible. Which step is most important to take before beginning the acquisition?
Select an answer first
4foundation · easy
What is the primary reason for extracting application data from a mobile device during an investigation?
Select an answer first
5foundation · easy
What is the primary reason to place a mobile device in airplane mode or a Faraday bag before acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Mobile Device Acquisition GBFA Practice Questions (Page 1)

Questions 1–5

A forensic examiner is about to acquire a mobile device that is evidence in a criminal case. The device is powered on and unlocked. The examiner must ensure the evidence is admissible in court. Which action is most important to take before beginning the acquisition?

What is the primary reason for extracting application data from a mobile device during an investigation?

What is the primary reason to place a mobile device in airplane mode or a Faraday bag before acquisition?

Keep studying — Mobile and Specialty Devices