GASF Mobile Evidence Acquisition Methods 3

Question 1

What is SIM card forensics and what data can be recovered from a SIM?

Accepted Answer

SIM forensics uses a SIM card reader to extract contacts, call records, SMS, and ICCID/IMSI from the SIM

Answer

SIM card forensics uses specialized readers to extract data stored on the SIM chip including contacts, SMS messages, last dialed numbers, ICCID, IMSI, and network data.

Question 2

What is the purpose of a write-blocker in mobile forensics?

Accepted Answer

To prevent any write operations to the evidence storage during acquisition, preserving its original state

Answer

A write-blocker is a hardware or software tool that intercepts write commands to storage media, ensuring the original evidence is not modified during forensic acquisition.

Question 3

What is 'Over-the-Air (OTA) extraction' in mobile forensics?

Accepted Answer

Acquiring device data from cloud services or MDM solutions without physical device access

Answer

OTA extraction acquires mobile data remotely from cloud backups, MDM-managed device profiles, or carrier records without needing physical possession of the device.

Question 4

What metadata should be documented when seizing a mobile device at a crime scene?

Accepted Answer

IMEI/MEID, phone number, carrier, battery level, network status, visible recent activity, and physical condition

Answer

Comprehensive seizure documentation includes device identifiers, carrier info, battery and network status, visible on-screen content, physical condition, and date/time of seizure.

Question 5

Why is it important to record the device's time and date display during seizure?

Accepted Answer

To identify time zone settings and detect clock manipulation that could affect timestamp interpretation

Answer

Recording the displayed time allows examiners to identify time zone discrepancies and clock manipulation, which is critical for accurate forensic timeline reconstruction.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF Mobile Evidence Acquisition Methods 3