A forensic examiner performs a physical acquisition of a mobile device and creates a forensic image. The examiner needs to ensure that the evidence is admissible in court. Which practice is most important to follow?

Document every step of the acquisition process, including the date, time, and personnel involved, and maintain a chain of custody log.

Perform the acquisition twice to ensure the image is consistent, and discard the first image.

Use the fastest acquisition tool available to minimize the time the device is in the examiner's possession.

Store the forensic image on the examiner's personal computer for easy access during analysis.

During a logical acquisition of a smartphone, the examiner needs to extract call logs, SMS messages, and contacts. Which method is most appropriate for this task?

Use a forensic tool that communicates with the device via USB to extract the SQLite databases.

Use a cloud backup to retrieve the data.

Perform a physical acquisition to image the entire storage.

Take screenshots of the call log, messages, and contacts screens.

When is a physical acquisition of a mobile device most appropriate?

When the device is locked and cannot be unlocked

When the device is an older model with limited API support

When the investigation only requires call logs and contacts

When the investigator needs to recover deleted data from the device's storage

Which of the following data types is commonly extracted from a mobile device during a forensic investigation?

Network router configuration files

Database transaction logs from a mainframe

What is the primary purpose of creating a forensic image of a mobile device's storage?

To compress the data so it takes up less space on the forensic workstation

To verify the device's model and firmware version

To extract only the user's contacts and messages

To create an exact, bit-for-bit copy of the storage for analysis without altering the original

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 1

Mobile Device Acquisition GBFA Practice Questions (Page 4)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 16–20

16application · medium
A forensic examiner performs a physical acquisition of a mobile device and creates a forensic image. The examiner needs to ensure that the evidence is admissible in court. Which practice is most important to follow?
Select an answer first
17application · medium
During a logical acquisition of a smartphone, the examiner needs to extract call logs, SMS messages, and contacts. Which method is most appropriate for this task?
Select an answer first
18foundation · easy
When is a physical acquisition of a mobile device most appropriate?
Select an answer first
19foundation · easy
Which of the following data types is commonly extracted from a mobile device during a forensic investigation?
Select an answer first
20foundation · easy
What is the primary purpose of creating a forensic image of a mobile device's storage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.