A forensic examiner is triaging a mobile device from a kidnapping investigation. The device is unlocked, but the examiner has only 15 minutes before the device must be returned to the investigating team for other processing. Which data type should be prioritized for rapid extraction?

Recent call logs, SMS/MMS messages, and GPS location history

Full filesystem image including deleted files

Device settings and Wi-Fi passwords

Installed applications list and app permissions

A small police department has a limited budget and needs to perform on-scene triage of mobile devices during search warrants. They need a solution that is portable, cost-effective, and can extract call logs, messages, and app data from common smartphones. Which approach best meets these needs?

Use a commercial mobile forensic triage tool that runs on a laptop and supports logical extraction.

Send all devices to a remote forensic lab for analysis.

Purchase a full forensic laboratory workstation with advanced chip-off capabilities.

Rely on manual examination of the device by the investigator.

A forensic examiner is triaging a mobile device at a crime scene. After taking photographs of the device and noting its condition, the examiner places it in a Faraday bag and seals it. Which additional step is essential to maintain chain of custody?

Document the date, time, location, and the names of all individuals who handled the device.

Erase the device's memory to prevent data tampering.

Immediately connect the device to a forensic workstation for acquisition.

Leave the device in the suspect's possession until a search warrant is obtained.

A forensic examiner is triaging a smartphone that is locked and has a known vulnerability in its lock screen. The examiner has a commercial tool that can exploit this vulnerability to bypass the lock. However, the tool's exploit may cause the device to reboot, which could trigger encryption. What is the best strategy?

Use the exploit, but be prepared to perform a physical acquisition if the device reboots and encrypts.

Use the exploit immediately and hope the device does not reboot.

Place the device in a Faraday bag and then use the exploit.

Connect the device to a power source to ensure it does not shut down during the exploit.

A forensic examiner has only 20 minutes to triage a seized smartphone before it must be returned to the owner due to a court order. The case involves allegations of drug trafficking. Which data type should be prioritized for extraction during this limited triage window?

Messaging application data and geolocation history

Installed application list and operating system version

Deleted file remnants from the user data partition

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 2

Mobile Device Triage GBFA Practice Questions (Page 2)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 6–10

6application · medium
A forensic examiner is triaging a mobile device from a kidnapping investigation. The device is unlocked, but the examiner has only 15 minutes before the device must be returned to the investigating team for other processing. Which data type should be prioritized for rapid extraction?
Select an answer first
7application · medium
A small police department has a limited budget and needs to perform on-scene triage of mobile devices during search warrants. They need a solution that is portable, cost-effective, and can extract call logs, messages, and app data from common smartphones. Which approach best meets these needs?
Select an answer first
8application · medium
A forensic examiner is triaging a mobile device at a crime scene. After taking photographs of the device and noting its condition, the examiner places it in a Faraday bag and seals it. Which additional step is essential to maintain chain of custody?
Select an answer first
9expert · hard
A forensic examiner is triaging a smartphone that is locked and has a known vulnerability in its lock screen. The examiner has a commercial tool that can exploit this vulnerability to bypass the lock. However, the tool's exploit may cause the device to reboot, which could trigger encryption. What is the best strategy?
Select an answer first
10application · medium
A forensic examiner has only 20 minutes to triage a seized smartphone before it must be returned to the owner due to a court order. The case involves allegations of drug trafficking. Which data type should be prioritized for extraction during this limited triage window?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.