Mobile Device Triage GBFA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a law enforcement raid, an investigator seizes a smartphone from a suspect who is actively communicating with an accomplice. The phone is powered on and unlocked. The investigator must preserve the most volatile evidence first. Which action should be taken immediately?

   • APower off the phone to prevent remote wiping.
   • BPlace the phone in airplane mode and record the current screen contents with a camera.
   • CConnect the phone to a forensic workstation and begin a full logical acquisition.
   • DRemove the SIM card and place the phone in a Faraday bag.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   In a corporate espionage investigation, an examiner has two mobile devices: one is a company-issued phone belonging to a former employee, and the other is the employee's personal phone. The company has a policy that allows inspection of company-issued devices but not personal devices. The investigation requires evidence of data exfiltration. What is the most appropriate triage strategy?

   • AExtract data from the company-issued device first, and seek legal authorization before accessing the personal device
   • BExtract data from both devices simultaneously to save time
   • CAsk the former employee for consent to search the personal device
   • DExtract only the personal device because it likely contains the exfiltration evidence
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   During mobile device triage, which type of data is typically given the highest priority for rapid extraction?

   • AContact lists and calendar entries
   • BInstalled application list and version numbers
   • CCall logs, text messages, and chat application data
   • DSystem logs and kernel dumps
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An examiner is triaging a smartphone in a child exploitation case. The device is locked, but the examiner has a warrant and a commercial tool that can bypass the lock. The examiner has limited time before the device's data may be remotely wiped. Which data type should be prioritized for extraction after bypassing the lock?

   • ASystem logs and diagnostic data
   • BImages, videos, and messaging application data
   • CCall logs and contact lists
   • DWeb browsing history and search terms
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An examiner is triaging a smartphone that is locked with a pattern lock. The examiner has a forensic tool that can perform a 'logical extraction' but requires the device to be unlocked. What is the most appropriate technique to unlock the device for triage?

   • AUse a forensic tool that exploits a known vulnerability to bypass the lock screen
   • BPerform a factory reset to remove the lock
   • CTry common patterns like 1234 or a straight line
   • DUse a JTAG probe to read the lock screen data
   Reveal Solution Discussion Select an answer first