A forensic examiner is triaging a mobile device that belongs to a journalist. The device contains confidential source information. The investigation is for a criminal case unrelated to the journalist's work. The examiner has legal authorization to search the device. What is the most appropriate action to protect the journalist's source information while still conducting the triage?

Refuse to perform the extraction due to the journalist's privilege

Extract only the device's metadata, not content

Perform a full logical extraction and review all data for relevance

Use a targeted extraction that filters for evidence relevant to the criminal case, avoiding source-related data

A forensic examiner is triaging a mobile device seized from a suspect. The examiner uses a forensic tool to extract data. After extraction, the examiner must ensure the evidence is admissible in court. What is the most critical action to maintain chain of custody?

Store the device in a secure evidence locker

Use a write blocker during extraction

Take a photograph of the device

Document every action taken with the device, including timestamps, examiner name, and purpose

In a terrorism investigation, an examiner has a smartphone that is on and unlocked. The examiner must quickly determine if the device contains bomb-making instructions. The device has a large amount of data, and the examiner has limited time. Which data type should be prioritized?

Web browsing history, search queries, and downloaded files

Installed applications and their permissions

What is a common technique used during mobile device triage to prevent remote data wiping?

Powering on the device and unlocking it

Placing the device in a Faraday bag

Connecting the device to a computer via USB

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 2

Mobile Device Triage GBFA Practice Questions (Page 4)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 16–20

16expert · hard
A forensic examiner is triaging a mobile device that belongs to a journalist. The device contains confidential source information. The investigation is for a criminal case unrelated to the journalist's work. The examiner has legal authorization to search the device. What is the most appropriate action to protect the journalist's source information while still conducting the triage?
Select an answer first
17foundation · easy
Which tool is commonly used for mobile device triage to perform a quick logical extraction of data?
Select an answer first
18application · medium
A forensic examiner is triaging a mobile device seized from a suspect. The examiner uses a forensic tool to extract data. After extraction, the examiner must ensure the evidence is admissible in court. What is the most critical action to maintain chain of custody?
Select an answer first
19expert · medium
In a terrorism investigation, an examiner has a smartphone that is on and unlocked. The examiner must quickly determine if the device contains bomb-making instructions. The device has a large amount of data, and the examiner has limited time. Which data type should be prioritized?
Select an answer first
20foundation · easy
What is a common technique used during mobile device triage to prevent remote data wiping?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Mobile Device Triage GBFA Practice Questions (Page 4)

Questions 16–20

Which tool is commonly used for mobile device triage to perform a quick logical extraction of data?

A forensic examiner is triaging a mobile device seized from a suspect. The examiner uses a forensic tool to extract data. After extraction, the examiner must ensure the evidence is admissible in court. What is the most critical action to maintain chain of custody?

In a terrorism investigation, an examiner has a smartphone that is on and unlocked. The examiner must quickly determine if the device contains bomb-making instructions. The device has a large amount of data, and the examiner has limited time. Which data type should be prioritized?

What is a common technique used during mobile device triage to prevent remote data wiping?

Keep studying — Mobile and Specialty Devices