An examiner is performing a physical acquisition of a mobile device using a chip-off technique. The device was powered off before the chip was removed. The examiner must decide whether to image the chip directly or attempt to decrypt the data first. Which factor is most important in this decision?

The legal authority to perform the chip-off acquisition.

The type of memory chip (e.g., eMMC, UFS) and its interface.

Whether the device was encrypted and if the decryption key is available.

The availability of a forensic tool that can decrypt the chip's data.

An examiner needs to acquire data from a smartphone that is locked and has encryption enabled. The examiner has the passcode but wants to preserve the device state and avoid altering data. Which acquisition method is most appropriate?

Perform a physical acquisition without unlocking the device, using a chip-off technique.

Unlock the device and perform a logical acquisition using a forensic tool.

Use a cloud extraction tool to retrieve data from the user's cloud account.

Perform a file system acquisition by booting the device into recovery mode.

A forensic examiner is tasked with extracting call logs, text messages, and contact information from a seized Android phone. The phone is unlocked and has USB debugging enabled. The examiner wants to minimize the risk of altering data on the device. Which acquisition method is most appropriate?

Perform a physical acquisition by booting the device into recovery mode and imaging the entire storage.

Perform a file system acquisition by using a forensic tool to parse the file system and extract all allocated files.

Perform a logical acquisition using ADB to pull the relevant databases and files.

Perform a cloud acquisition by accessing the user's Google account to retrieve the data.

A forensic examiner is called to acquire a mobile device that is suspected of containing evidence of a cybercrime. The device is a smartphone that is powered on and unlocked. The examiner must decide whether to perform a live acquisition or to power off the device and perform a dead acquisition. Which factor most strongly favors a live acquisition?

The device is connected to a cellular network and may be remotely wiped.

The device is encrypted and the decryption keys are in memory.

The examiner has a warrant and the user's consent.

The device is not encrypted and the bootloader is unlocked.

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 1

Mobile Device Acquisition GBFA Practice Questions (Page 5)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 21–25

21expert · hard
An examiner is performing a physical acquisition of a mobile device using a chip-off technique. The device was powered off before the chip was removed. The examiner must decide whether to image the chip directly or attempt to decrypt the data first. Which factor is most important in this decision?
Select an answer first
22application · medium
An examiner needs to acquire data from a smartphone that is locked and has encryption enabled. The examiner has the passcode but wants to preserve the device state and avoid altering data. Which acquisition method is most appropriate?
Select an answer first
23application · medium
A forensic examiner is tasked with extracting call logs, text messages, and contact information from a seized Android phone. The phone is unlocked and has USB debugging enabled. The examiner wants to minimize the risk of altering data on the device. Which acquisition method is most appropriate?
Select an answer first
24expert · hard
A forensic examiner is called to acquire a mobile device that is suspected of containing evidence of a cybercrime. The device is a smartphone that is powered on and unlocked. The examiner must decide whether to perform a live acquisition or to power off the device and perform a dead acquisition. Which factor most strongly favors a live acquisition?
Select an answer first
25application · medium
An examiner needs to recover deleted text messages and a suspect's recent location history from an Android device. The device is not rooted and the bootloader is locked. Which acquisition method is most appropriate to maximize data recovery under these constraints?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Mobile Device Acquisition GBFA Practice Questions (Page 5)

Questions 21–25

An examiner is performing a physical acquisition of a mobile device using a chip-off technique. The device was powered off before the chip was removed. The examiner must decide whether to image the chip directly or attempt to decrypt the data first. Which factor is most important in this decision?

An examiner needs to acquire data from a smartphone that is locked and has encryption enabled. The examiner has the passcode but wants to preserve the device state and avoid altering data. Which acquisition method is most appropriate?

A forensic examiner is tasked with extracting call logs, text messages, and contact information from a seized Android phone. The phone is unlocked and has USB debugging enabled. The examiner wants to minimize the risk of altering data on the device. Which acquisition method is most appropriate?

An examiner needs to recover deleted text messages and a suspect's recent location history from an Android device. The device is not rooted and the bootloader is locked. Which acquisition method is most appropriate to maximize data recovery under these constraints?

Keep studying — Mobile and Specialty Devices