A forensic examiner is triaging a smartphone belonging to a victim of cyberstalking. The victim is present and has provided consent. The examiner needs to quickly identify evidence of harassing communications and the perpetrator's identity. Which data source should be examined first?

The device's web browsing history

The messaging applications and associated account identifiers

The device's Bluetooth pairing history

Which statement best describes the role of mobile device triage in a forensic investigation?

It is a substitute for a full forensic examination in all cases

It is a process to permanently erase data to protect privacy

It is an initial, time-sensitive assessment to locate and preserve high-value evidence

It is a legal procedure to obtain a search warrant for the device

In a missing person case, an examiner has the missing person's smartphone. The device is on and unlocked. Which data type should be prioritized to determine the person's last known location and activities?

Device's MAC address and Wi-Fi settings

Installed applications and their version numbers

GPS location history, recent calls, and messaging app data

An examiner is triaging a mobile device found at a crime scene. The device is not listed in the search warrant, but it is believed to belong to a victim. The examiner needs to quickly determine if the device contains evidence related to the crime. What is the most legally sound action?

Perform a cursory search of the device for victim identification only.

Seize the device and obtain a separate warrant before examination.

Examine the device under the plain view doctrine if the screen shows incriminating evidence.

Ask the victim for consent to examine the device.

An examiner is triaging a smartphone that is not rooted and has a locked bootloader. The device is on and unlocked. The examiner needs to extract call logs and SMS messages quickly. Which technique is most appropriate?

Cloud extraction from the user's cloud account

Logical extraction using a forensic tool that leverages the device's backup APIs

Manual review and photographing of the screen

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 2

Mobile Device Triage GBFA Practice Questions (Page 6)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

5concepts

Questions 26–30

26application · medium
A forensic examiner is triaging a smartphone belonging to a victim of cyberstalking. The victim is present and has provided consent. The examiner needs to quickly identify evidence of harassing communications and the perpetrator's identity. Which data source should be examined first?
Select an answer first
27foundation · easy
Which statement best describes the role of mobile device triage in a forensic investigation?
Select an answer first
28application · medium
In a missing person case, an examiner has the missing person's smartphone. The device is on and unlocked. Which data type should be prioritized to determine the person's last known location and activities?
Select an answer first
29expert · hard
An examiner is triaging a mobile device found at a crime scene. The device is not listed in the search warrant, but it is believed to belong to a victim. The examiner needs to quickly determine if the device contains evidence related to the crime. What is the most legally sound action?
Select an answer first
30application · medium
An examiner is triaging a smartphone that is not rooted and has a locked bootloader. The device is on and unlocked. The examiner needs to extract call logs and SMS messages quickly. Which technique is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.