What is the primary purpose of maintaining a chain of custody during mobile device triage?

To determine the device's owner

To ensure the device is not damaged during extraction

To document every person who handled the device and every action taken

A forensic examiner is triaging a smartphone in a corporate espionage case. The device is locked, but the examiner has the passcode from a previous consent search. The device is connected to a corporate Exchange server. The examiner needs to prioritize data that will show the exfiltration of trade secrets. Which data type is most important?

Email application data and attachments

An examiner is triaging a feature phone (non-smartphone) that may contain evidence in a fraud case. The phone does not support modern forensic extraction tools. What is the most appropriate triage technique?

Use a JTAG probe to read the flash memory directly.

Photograph the phone's screen and manually navigate through menus to document relevant data.

Attempt to install a custom recovery image to enable logical extraction.

Perform a chip-off and read the NAND flash with a programmer.

A forensic examiner is triaging a mobile device in a cross-border investigation. The device is from a foreign national, and the data may be subject to data residency laws. The examiner has legal authorization from the local jurisdiction. What is the most important consideration before extracting data?

Extract only data that is stored locally on the device, avoiding cloud data

Proceed with extraction because the local legal authorization is sufficient

Determine whether the extraction and transfer of data comply with both local and foreign data protection laws

Use a forensic tool that encrypts the extracted data

A digital forensics team is triaging multiple mobile devices from a drug trafficking investigation. The team has limited time and must prioritize which devices to process first. Which factor should be the primary consideration?

The device that is easiest to extract, regardless of content

The device with the newest model and highest storage capacity

The device belonging to the suspect with the highest rank in the organization

The device most likely to contain evidence directly related to the investigation, such as communication with known associates

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 2

Mobile Device Triage GBFA Practice Questions (Page 3)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 11–15

11foundation · easy
What is the primary purpose of maintaining a chain of custody during mobile device triage?
Select an answer first
12expert · hard
A forensic examiner is triaging a smartphone in a corporate espionage case. The device is locked, but the examiner has the passcode from a previous consent search. The device is connected to a corporate Exchange server. The examiner needs to prioritize data that will show the exfiltration of trade secrets. Which data type is most important?
Select an answer first
13application · medium
An examiner is triaging a feature phone (non-smartphone) that may contain evidence in a fraud case. The phone does not support modern forensic extraction tools. What is the most appropriate triage technique?
Select an answer first
14expert · hard
A forensic examiner is triaging a mobile device in a cross-border investigation. The device is from a foreign national, and the data may be subject to data residency laws. The examiner has legal authorization from the local jurisdiction. What is the most important consideration before extracting data?
Select an answer first
15application · medium
A digital forensics team is triaging multiple mobile devices from a drug trafficking investigation. The team has limited time and must prioritize which devices to process first. Which factor should be the primary consideration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Mobile Device Triage GBFA Practice Questions (Page 3)

Questions 11–15

What is the primary purpose of maintaining a chain of custody during mobile device triage?

An examiner is triaging a feature phone (non-smartphone) that may contain evidence in a fraud case. The phone does not support modern forensic extraction tools. What is the most appropriate triage technique?

A digital forensics team is triaging multiple mobile devices from a drug trafficking investigation. The team has limited time and must prioritize which devices to process first. Which factor should be the primary consideration?

Keep studying — Mobile and Specialty Devices