An examiner needs to acquire data from a smart appliance that has a JTAG test point on the circuit board. The device's flash memory is not encrypted. What is the most appropriate acquisition method?

Attempt a logical acquisition via the USB port.

Perform a chip-off to remove the flash chip.

Use JTAG to read the flash memory directly.

Use the device's network interface to extract data.

A smart thermostat is seized as evidence. It has internal flash memory and a network connection. The investigator wants to preserve the device for later forensic analysis. What is the BEST way to handle the device to maintain chain of custody and data integrity?

Power it down immediately to prevent data loss.

Reset the device to factory settings to ensure a clean state.

Leave it connected to the network to allow remote access by the vendor.

Disconnect it from the network, document its state, and store it in a secure evidence bag.

An investigator has a smart lock that is encrypted and has a proprietary interface. The vendor offers a forensic tool but it requires a paid license and the investigator's budget is limited. The lock is critical evidence in a burglary case. What is the BEST course of action?

Document the inability to acquire data and return the device.

Use a generic JTAG interface to read the flash.

Purchase the vendor's forensic tool to ensure a proper acquisition.

Attempt a chip-off to bypass encryption.

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 3

Specialty Device Fundamentals GBFA Practice Questions (Page 4)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 16–20

16application · medium
An examiner needs to acquire data from a smart appliance that has a JTAG test point on the circuit board. The device's flash memory is not encrypted. What is the most appropriate acquisition method?
Select an answer first
17application · medium
During a search, an investigator finds a smart thermostat, a connected door lock, and a wireless camera. Which device is most likely to store historical event logs that could be relevant to the investigation?
Select an answer first
18application · medium
A smart thermostat is seized as evidence. It has internal flash memory and a network connection. The investigator wants to preserve the device for later forensic analysis. What is the BEST way to handle the device to maintain chain of custody and data integrity?
Select an answer first
19expert · hard
An investigator has a smart lock that is encrypted and has a proprietary interface. The vendor offers a forensic tool but it requires a paid license and the investigator's budget is limited. The lock is critical evidence in a burglary case. What is the BEST course of action?
Select an answer first
20foundation · easy
Which acquisition method involves physically removing the memory chip from a specialty device and reading it with specialized hardware?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.

Specialty Device Fundamentals GBFA Practice Questions (Page 4)

Questions 16–20

An examiner needs to acquire data from a smart appliance that has a JTAG test point on the circuit board. The device's flash memory is not encrypted. What is the most appropriate acquisition method?

During a search, an investigator finds a smart thermostat, a connected door lock, and a wireless camera. Which device is most likely to store historical event logs that could be relevant to the investigation?

A smart thermostat is seized as evidence. It has internal flash memory and a network connection. The investigator wants to preserve the device for later forensic analysis. What is the BEST way to handle the device to maintain chain of custody and data integrity?

An investigator has a smart lock that is encrypted and has a proprietary interface. The vendor offers a forensic tool but it requires a paid license and the investigator's budget is limited. The lock is critical evidence in a burglary case. What is the BEST course of action?

Which acquisition method involves physically removing the memory chip from a specialty device and reading it with specialized hardware?

Keep studying — Mobile and Specialty Devices