What is the primary purpose of mobile device acquisition in a forensic investigation?

To erase the device's data to prevent unauthorized access

To determine the owner of the device from its serial number

To create a bit-for-bit copy of the device's storage for analysis

To unlock the device and access its contents for investigative review

What is the primary purpose of maintaining a chain of custody for a mobile device?

To list the applications installed on the device

To ensure the device is charged and ready for acquisition

To determine the market value of the device

To prove that the evidence has not been tampered with from the time of seizure to presentation in court

What is a common strategy for dealing with a locked mobile device during acquisition?

Ignoring the lock and proceeding with a logical acquisition

Attempting to bypass the lock using forensic tools or techniques

Sending the device back to the manufacturer for unlocking

Erasing the device to remove the lock

What is a key challenge when acquiring data from an encrypted mobile device?

The device may not have enough storage space for the image

The device may be physically damaged

The data may be unreadable without the decryption key

The device may be too old to support forensic tools

A forensic examiner needs to acquire the full storage contents of a seized Android phone for later analysis. The phone is powered off and has no screen lock. The examiner wants to preserve the exact bit-for-bit state of the internal storage. Which acquisition method is most appropriate?

Perform a cloud acquisition by accessing the user's cloud backup to retrieve the phone's data.

Perform a file system acquisition by using a forensic tool to parse the file system and extract all allocated files.

Perform a physical acquisition by booting the device into a custom recovery image and using dd to image the userdata partition.

Perform a logical acquisition using Android Debug Bridge (ADB) to pull all files from the /sdcard directory.

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 1

Mobile Device Acquisition GBFA Practice Questions (Page 2)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 6–10

6foundation · easy
What is the primary purpose of mobile device acquisition in a forensic investigation?
Select an answer first
7foundation · easy
What is the primary purpose of maintaining a chain of custody for a mobile device?
Select an answer first
8foundation · easy
What is a common strategy for dealing with a locked mobile device during acquisition?
Select an answer first
9foundation · easy
What is a key challenge when acquiring data from an encrypted mobile device?
Select an answer first
10application · medium
A forensic examiner needs to acquire the full storage contents of a seized Android phone for later analysis. The phone is powered off and has no screen lock. The examiner wants to preserve the exact bit-for-bit state of the internal storage. Which acquisition method is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.