Specialty Device Fundamentals GBFA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which action is essential to maintain chain of custody when seizing a specialty device?

   • ADocumenting the device's unique identifiers and every person who handles it.
   • BKeeping the device in a public area to ensure transparency.
   • CImmediately powering on the device to check for data.
   • DAllowing only the lead investigator to handle the device.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An examiner seizes a smart speaker that is still powered on and connected to Wi-Fi. The speaker has a built-in microphone and stores voice recordings locally. What is the best way to preserve the voice recordings?

   • AKeep the speaker powered on and connected to Wi-Fi to allow cloud sync.
   • BDisconnect the speaker from Wi-Fi and power, then document the state and place it in a Faraday bag.
   • CRemove the speaker's memory chip immediately without documentation.
   • DSpeak commands to the speaker to test if it records.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A drone is captured with a damaged microSD card. The card is the only source of flight logs. What is the BEST way to preserve the card for later data recovery?

   • AInsert the card into a reader and attempt to image it immediately.
   • BPlace the card in a static-free bag and store it in a cool, dry environment.
   • CClean the card's contacts with a solvent.
   • DWrap the card in aluminum foil to protect it from static.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which acquisition method for a specialty device uses the device's own communication interface to copy data without altering the device?

   • ALogical acquisition
   • BPhysical acquisition
   • CJTAG
   • DChip-off
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An examiner is at a scene with a smart TV that is suspected of storing viewing history. The TV is mounted on a wall and has a USB port. The examiner has a write blocker and a USB drive. The TV's storage is encrypted, but the TV is currently in standby mode. What is the most appropriate acquisition method?

   • AWake the TV from standby and use the USB port to perform a logical acquisition.
   • BRemove the TV's storage chip and perform a chip-off acquisition.
   • CUse the TV's network port to extract data remotely.
   • DDisconnect the TV from power and transport it to the lab for chip-off.
   Reveal Solution Discussion Select an answer first