GASF Mobile Evidence Acquisition Methods 2

Question 1

What is cloud acquisition in mobile forensics and what authentication is typically required?

Accepted Answer

Extracting data from cloud backup services using account credentials or legal process/tokens

Answer

Cloud acquisition involves using account credentials, authentication tokens, or legal process responses to extract synchronized data from cloud services like iCloud or Google.

Question 2

Which Cellebrite product is specifically designed for physical and logical mobile device extraction?

Accepted Answer

Cellebrite UFED (Universal Forensic Extraction Device)

Answer

Cellebrite UFED is the primary extraction hardware/software platform supporting physical, logical, and file system acquisitions across thousands of mobile device models.

Question 3

What does a 'logical' acquisition capture from a mobile device?

Accepted Answer

Data accessible through the operating system's standard APIs and file system interface

Answer

Logical acquisition uses OS-level interfaces (iTunes API, ADB, etc.) to collect data that the operating system can access, excluding unallocated space and deleted files.

Question 4

In mobile forensics, what is the significance of preserving volatile data before powering down a device?

Accepted Answer

Volatile memory may hold decryption keys, running process data, and temporary files lost on power-off

Answer

Device RAM may contain active encryption keys, decrypted data, running process information, and temporary artifacts that are permanently lost when the device loses power.

Question 5

What is 'EDL (Emergency Download) mode' on Qualcomm-based Android devices and its forensic use?

Accepted Answer

A low-level Qualcomm bootloader mode allowing direct flash memory read/write for acquisition

Answer

EDL mode is a Qualcomm-specific bootloader mode that allows direct communication with flash memory, enabling forensic tools to acquire raw images from many Android devices.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF Mobile Evidence Acquisition Methods 2