An investigator encounters a wearable fitness tracker with a proprietary charging connector and no standard USB interface. The device is encrypted and the vendor does not provide forensic tools. What is the MOST practical first step to acquire data?

Contact the vendor for proprietary tools or technical documentation.

Perform a chip-off immediately to bypass encryption.

Place the device in a Faraday bag and wait for the battery to drain.

Use a generic USB cable to connect to the device.

Which factor is a significant challenge when extracting data from a wearable device?

The device has no encryption, making extraction trivial.

The device uses a standard SATA interface for data transfer.

The device may have limited storage and sync data to the cloud, so the local data may be incomplete.

The device's storage is always removable and easy to image.

An examiner is trying to extract data from a smart home hub that uses a proprietary encrypted file system. The device has a microSD slot, but the card is not present. The manufacturer's debug port is accessible. What is the most likely challenge the examiner will face?

The debug port will require a proprietary cable that is unavailable.

The device will automatically erase data when the debug port is accessed.

The file system encryption will prevent direct reading of the flash chip.

The microSD slot is the only place data is stored.

A forensic team is investigating a hit-and-run involving a vehicle with an onboard telematics unit. The unit is proprietary and has no external data port. What is the most appropriate acquisition method to retrieve event data?

Perform a logical acquisition through the infotainment system.

Remove the telematics unit and perform a chip-off acquisition.

Use the OBD-II port to extract data.

Contact the vehicle manufacturer for cloud data.

A forensic team seizes a smart home hub that is connected to multiple IoT devices. The hub is still powered on and has an active internet connection. The team needs to preserve the hub's data, but the hub's storage is encrypted and the decryption key is in the hub's RAM. What is the most appropriate action?

Remove the hub's storage chip and read it with a chip-off technique.

Immediately disconnect the hub from the internet and power it down.

Perform a cold boot attack to capture the RAM contents before powering down.

Use the hub's network connection to back up data to a forensic server.

GIAC Battlefield Forensics and Acquisition

Domain 4Objective 3

Specialty Device Fundamentals GBFA Practice Questions (Page 6)

Part of the Mobile and Specialty Devices domain, which makes up ~13% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 26–30

26application · medium
An investigator encounters a wearable fitness tracker with a proprietary charging connector and no standard USB interface. The device is encrypted and the vendor does not provide forensic tools. What is the MOST practical first step to acquire data?
Select an answer first
27foundation · easy
Which factor is a significant challenge when extracting data from a wearable device?
Select an answer first
28application · medium
An examiner is trying to extract data from a smart home hub that uses a proprietary encrypted file system. The device has a microSD slot, but the card is not present. The manufacturer's debug port is accessible. What is the most likely challenge the examiner will face?
Select an answer first
29application · medium
A forensic team is investigating a hit-and-run involving a vehicle with an onboard telematics unit. The unit is proprietary and has no external data port. What is the most appropriate acquisition method to retrieve event data?
Select an answer first
30expert · hard
A forensic team seizes a smart home hub that is connected to multiple IoT devices. The hub is still powered on and has an active internet connection. The team needs to preserve the hub's data, but the hub's storage is encrypted and the decryption key is in the hub's RAM. What is the most appropriate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GBFA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GBFA” is a trademark of its owner, used for identification only.