An examiner is acquiring a mobile device that is evidence in a civil litigation case. The device is a company-issued phone. The examiner must ensure the acquisition is defensible and the chain of custody is maintained. Which action is most critical?

Document every person who handles the device and every action taken during the acquisition.

Use a write-blocker to prevent any changes to the device.

Perform a physical acquisition to capture all data.

Obtain a warrant or legal authorization.

During a mobile device acquisition, the examiner notices that the device's screen changes after connecting it to the forensic workstation. The examiner must document this event. What is the most appropriate action?

Power off the device immediately to prevent further changes.

Restart the acquisition from the beginning.

Ignore the change because it does not affect the acquired data.

Note the change in the acquisition notes and include it in the final report.

An examiner is performing a physical acquisition of an Android phone. The device is rooted and the bootloader is unlocked. The examiner wants to create a forensic image of the userdata partition. Which tool or technique is most appropriate?

Use a file manager app to copy the userdata folder to an external SD card.

Use `dd` over ADB to image the block device, then hash the image with SHA-256.

Use the Android backup command to create a full backup of app data.

Use a cloud backup service to retrieve the data.

Which of the following should be documented during the mobile device acquisition process?

The make, model, and serial number of the device

The weather conditions at the time of seizure

The investigator's personal opinions about the case

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 1

Mobile Device Acquisition GBFA Practice Questions (Page 6)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

7concepts

Questions 26–30

26expert · hard
An examiner is acquiring a mobile device that is evidence in a civil litigation case. The device is a company-issued phone. The examiner must ensure the acquisition is defensible and the chain of custody is maintained. Which action is most critical?
Select an answer first
27application · medium
During a mobile device acquisition, the examiner notices that the device's screen changes after connecting it to the forensic workstation. The examiner must document this event. What is the most appropriate action?
Select an answer first
28application · medium
An examiner is performing a physical acquisition of an Android phone. The device is rooted and the bootloader is unlocked. The examiner wants to create a forensic image of the userdata partition. Which tool or technique is most appropriate?
Select an answer first
29foundation · easy
Which of the following should be documented during the mobile device acquisition process?
Select an answer first
30foundation · easy
Which of the following is a common tool used to perform a forensic image of a mobile device?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.