Specialty Device Fundamentals GBFA Practice Questions (Page 8)

Questions 36–37

1. 36expert · hard

   A forensic team is investigating a case involving a smart speaker. The device is encrypted and the vendor does not provide a forensic tool. The team has a warrant to search the cloud account associated with the device. What is the BEST acquisition strategy?

   • AReturn the device without acquisition because it is encrypted.
   • BAcquire the cloud data from the vendor via the warrant, and document the device's inability to be acquired locally.
   • CPerform a chip-off of the device's flash memory to bypass encryption.
   • DUse a JTAG interface to read the flash memory.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a search warrant execution, an investigator locates a consumer drone, a fitness tracker, and a smart doorbell. The drone's SD card is easily removed, but the fitness tracker and doorbell have no external ports. The investigator must prioritize evidence collection to preserve data integrity. What is the most appropriate initial action?

   • ARemove the SD card from the drone, then place the drone, tracker, and doorbell in separate Faraday bags.
   • BPlace all devices in one large evidence bag to maintain chain of custody.
   • CImmediately connect the drone to a laptop to perform a logical acquisition.
   • DPower on each device to check for data, then document any visible information.
   Reveal Solution Discussion Select an answer first