Mobile Device Acquisition GBFA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An examiner receives a smartphone that is encrypted and locked. The device is powered on and shows a lock screen. The examiner has a warrant to search the device. Which strategy is most appropriate to attempt to gain access to the device?

   • AUse a forensic tool that supports brute-force or dictionary attacks on the lock screen passcode.
   • BContact the device manufacturer to request a backdoor or unlock code.
   • CPerform a physical acquisition by connecting the device to a forensic workstation and imaging the storage.
   • DPlace the device in a Faraday bag and wait for the battery to drain, then attempt to boot it into recovery mode.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An examiner is performing a physical acquisition of a mobile device. The examiner wants to ensure the image is an exact duplicate of the original storage. Which step is essential?

   • AHash the original storage and the image with a cryptographic hash algorithm and compare the hashes.
   • BUse a logical acquisition tool to extract data.
   • CDocument the acquisition process and maintain chain of custody.
   • DUse a write-blocker to prevent any writes to the original device.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An examiner is investigating a case involving a smartphone that is locked and encrypted. The examiner has obtained a court order to access the device. The device is an older Android model with a known vulnerability that allows bypassing the lock screen. Which acquisition method is most appropriate?

   • AExploit the vulnerability to bypass the lock screen and then perform a logical acquisition.
   • BUse a brute-force attack on the passcode without exploiting the vulnerability.
   • CPerform a physical acquisition using a chip-off technique to read the storage directly.
   • DContact the manufacturer for a backdoor to unlock the device.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which acquisition method extracts only the active data that the operating system exposes through its APIs, such as call logs and contacts, without capturing deleted files?

   • AFile system acquisition
   • BCloud acquisition
   • CLogical acquisition
   • DPhysical acquisition
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An examiner needs to create a forensic image of a mobile device's internal storage. The device is rooted and has USB debugging enabled. The examiner wants to ensure the image is authentic and unaltered. Which tool and technique is most appropriate?

   • AUse a commercial forensic tool that performs a logical acquisition and generates a report.
   • BUse dd to image the block device and calculate a SHA-256 hash of the image.
   • CUse adb pull to copy all files from the /data directory.
   • DUse a cloud backup to create an image of the device's data.
   Reveal Solution Discussion Select an answer first