A forensic examiner needs to extract call logs, SMS messages, and app data from an iPhone that is locked with a passcode. The device is running iOS 15 and has not been backed up to iCloud. What is the most appropriate acquisition method?

Use a cloud extraction service to pull data from Apple's servers

Boot the device into DFU mode and image the NAND

Perform a logical acquisition using iTunes backup after unlocking the device

Perform a physical acquisition using a JTAG probe

Which procedure is essential when acquiring data from a mobile device to maintain evidence integrity?

Place the device in airplane mode or a Faraday bag to prevent network communication

Remove the SIM card and immediately insert it into a forensic reader

Power on the device and browse through apps to find relevant data

Connect the device to a computer and sync it to back up all data

An examiner has completed the analysis of a mobile device and needs to document the findings. Which element is essential to include in the report to ensure the findings are admissible in court?

The cost of the forensic tools used.

The suspect's social media posts.

The chain of custody for the device.

The examiner's personal opinion about the suspect's guilt.

What is the primary purpose of Windows Prefetch files in forensic analysis?

To store the contents of files that were recently deleted

To indicate which applications have been executed and how many times

To store user passwords and credentials

To log all network connections made by the system

An examiner is analyzing an NTFS volume and finds that the $MFT is corrupted. The examiner needs to recover files and build a timeline. What is the most appropriate approach?

Run chkdsk to repair the $MFT and then image the volume

Use file carving and parse the $LogFile and $UsnJrnl to recover file metadata and timestamps

Ignore the $MFT and rely on the directory indexes

Use the $Bitmap to reconstruct the file system

GIAC Certified Forensic Examiner

Domain 4Objective 1

System and Device Analysis GCFE Practice Questions (Page 5)

Part of the System and Device Analysis domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

9concepts

Questions 21–25

21application · medium
A forensic examiner needs to extract call logs, SMS messages, and app data from an iPhone that is locked with a passcode. The device is running iOS 15 and has not been backed up to iCloud. What is the most appropriate acquisition method?
Select an answer first
22foundation · easy
Which procedure is essential when acquiring data from a mobile device to maintain evidence integrity?
Select an answer first
23application · medium
An examiner has completed the analysis of a mobile device and needs to document the findings. Which element is essential to include in the report to ensure the findings are admissible in court?
Select an answer first
24foundation · easy
What is the primary purpose of Windows Prefetch files in forensic analysis?
Select an answer first
25expert · hard
An examiner is analyzing an NTFS volume and finds that the $MFT is corrupted. The examiner needs to recover files and build a timeline. What is the most appropriate approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.