GASF Mobile Evidence Acquisition Methods 3

Question 1

What is SIM card forensics and what data can be recovered from a SIM?

Accepted Answer

SIM forensics uses a SIM card reader to extract contacts, call records, SMS, and ICCID/IMSI from the SIM

Answer

SIM forensics involves cloud data extraction; recovers social media data

Answer

SIM forensics requires carrier cooperation; recovers tower connection logs

Answer

SIM forensics decrypts voicemail; recovers audio recordings

Question 2

What is the purpose of a write-blocker in mobile forensics?

Accepted Answer

To prevent any write operations to the evidence storage during acquisition, preserving its original state

Answer

To prevent the examiner from writing incorrect reports

Answer

To block Wi-Fi writes during cloud backup acquisition

Answer

To prevent app data from being overwritten by background processes

Question 3

What is 'Over-the-Air (OTA) extraction' in mobile forensics?

Accepted Answer

Acquiring device data from cloud services or MDM solutions without physical device access

Answer

Extracting data from the device via Bluetooth proximity

Answer

Using cellular signals to extract baseband data

Answer

Intercepting unencrypted Wi-Fi traffic from the device

Question 4

What metadata should be documented when seizing a mobile device at a crime scene?

Accepted Answer

IMEI/MEID, phone number, carrier, battery level, network status, visible recent activity, and physical condition

Answer

Only the device model and serial number

Answer

Only photos of the device screen

Answer

Only the device PIN if voluntarily provided

Question 5

Why is it important to record the device's time and date display during seizure?

Accepted Answer

To identify time zone settings and detect clock manipulation that could affect timestamp interpretation

Answer

To verify the device is charging properly

Answer

To determine when the next scheduled backup will occur

Answer

To assess whether the device is in Do Not Disturb mode

Question 6

What is the forensic significance of 'deleted' data on mobile NAND flash storage?

Accepted Answer

Deleted data may persist in unallocated NAND pages until overwritten by wear-leveling or garbage collection

Answer

Deleted data is immediately and permanently erased on all NAND flash devices

Answer

Deleted data is moved to a hidden recovery partition automatically

Answer

NAND flash instantly overwrites deleted sectors with zeros