A field investigator encounters a locked Android phone that is suspected to contain evidence of a kidnapping. The phone is powered on and has a pattern lock. The investigator has a warrant and needs to extract data quickly. Which technique is most appropriate for triage?

Power off the device and remove the battery to prevent data alteration.

Use a commercial mobile forensic tool that supports lock bypass and logical extraction.

Attempt to brute-force the pattern lock manually.

Perform a physical acquisition using JTAG or chip-off techniques.

During a mobile device triage, an examiner finds that the device is connected to a cloud backup service. The examiner has a warrant that allows seizure of the device but does not explicitly mention cloud data. What is the most appropriate action regarding the cloud data?

Document the cloud service and account information, but do not access the cloud data without additional legal authorization.

Ignore the cloud data because it is not part of the device.

Access the cloud backup immediately using credentials found on the device.

Ask the suspect to provide the cloud password voluntarily.

A forensic examiner is triaging a mobile device at a crime scene. The device is on, but the screen is locked. The examiner needs to preserve volatile data and prevent remote wiping. Which sequence of actions best follows triage best practices?

Isolate the device from the network, document the screen, and then attempt to bypass the lock using forensic tools

Immediately connect the device to a forensic workstation to begin extraction

Power off the device to preserve battery and prevent network access

Remove the battery and SIM card immediately

Why are messages and chat logs prioritized over other data types during mobile device triage?

They are the easiest data to extract without a warrant

They are typically the most volatile and may be lost if the device is powered off

They are the only data types that can be legally extracted

They are the largest data files on the device

Which legal consideration is most important before beginning triage on a mobile device?

Ensuring the device is fully charged

Having the latest forensic software

Obtaining proper legal authority, such as a warrant or consent

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 2

Mobile Device Triage GBFA Practice Questions (Page 1)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 1–5

1application · medium
A field investigator encounters a locked Android phone that is suspected to contain evidence of a kidnapping. The phone is powered on and has a pattern lock. The investigator has a warrant and needs to extract data quickly. Which technique is most appropriate for triage?
Select an answer first
2application · medium
During a mobile device triage, an examiner finds that the device is connected to a cloud backup service. The examiner has a warrant that allows seizure of the device but does not explicitly mention cloud data. What is the most appropriate action regarding the cloud data?
Select an answer first
3application · medium
A forensic examiner is triaging a mobile device at a crime scene. The device is on, but the screen is locked. The examiner needs to preserve volatile data and prevent remote wiping. Which sequence of actions best follows triage best practices?
Select an answer first
4foundation · easy
Why are messages and chat logs prioritized over other data types during mobile device triage?
Select an answer first
5foundation · easy
Which legal consideration is most important before beginning triage on a mobile device?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.