Specialty Device Fundamentals GBFA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a common challenge when extracting data from specialty devices like drones or IoT sensors?

   • AThey have no data storage, so extraction is unnecessary.
   • BThey often use proprietary interfaces and file formats that require vendor-specific tools.
   • CThey always have removable storage that is easy to access.
   • DThey use standard file systems like NTFS that are universally supported.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An examiner has a drone that crashed and is damaged. The drone's SD card is intact, but the drone's main board is partially destroyed. The examiner needs to recover flight logs. The SD card is encrypted with a key stored in the drone's firmware. What is the most appropriate approach?

   • ARead the SD card directly with a write blocker; the encryption may not be enabled.
   • BPerform a logical acquisition via the drone's USB port.
   • CContact the manufacturer for a decryption tool.
   • DAttempt to extract the encryption key from the damaged firmware chip using JTAG or chip-off.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A forensic team seizes a smartwatch from a suspect. The watch is paired with a phone that is not in custody. The team must transport the watch to a lab 200 miles away. What is the best practice to preserve the watch's data?

   • APlace the watch in a Faraday bag and maintain a chain-of-custody log.
   • BKeep the watch near the phone to maintain the Bluetooth pairing.
   • CPower off the watch and store it in a standard evidence envelope.
   • DCharge the watch to ensure it does not power off during transport.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A wearable fitness tracker is seized as evidence. The device is paired with a smartphone that is also seized. What is the BEST practice for preserving the relationship between the devices?

   • APower on both devices to ensure they are still paired.
   • BDocument the pairing information and keep both devices in separate evidence bags.
   • CDisconnect the Bluetooth pairing to prevent data transfer.
   • DPlace both devices in the same evidence bag to keep them together.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A forensic examiner encounters a consumer drone at a crime scene. Which storage characteristic is most typical for this type of specialty device?

   • AIt stores all data exclusively in cloud storage with no local storage capability.
   • BIt uses a standard NTFS partition that can be mounted and read by any forensic tool.
   • CIt has no data storage and only streams video to a mobile device.
   • DIt uses a proprietary file system on a microSD card that may require vendor-specific tools to parse.
   Reveal Solution Discussion Select an answer first