GASF Mobile Evidence Acquisition Methods

Question 1

What is the order of acquisition methods from least to most data yield on mobile devices?

Accepted Answer

Logical < File System < Physical, with Cloud varying by provider

Answer

Physical > Logical > File System > Cloud

Answer

Cloud > Logical > File System > Physical

Answer

Logical > Cloud > Physical > File System

Question 2

What is JTAG acquisition and when is it used in mobile forensics?

Accepted Answer

A hardware technique using test access points on the PCB to read memory via the device's debug interface

Answer

A Wi-Fi-based extraction method for iOS devices

Answer

A software-only method for extracting app data

Answer

A SIM card extraction technique

Question 3

Which principle requires that forensic examiners work on a copy of evidence rather than the original device storage?

Accepted Answer

Working copy principle (forensic imaging)

Answer

Chain of custody

Answer

Best evidence rule

Answer

Non-repudiation

Question 4

What hashing algorithm is most commonly used to verify the integrity of a mobile forensic image?

Accepted Answer

SHA-256

Answer

MD5

Answer

SHA-1

Answer

CRC32

Question 5

What is 'ISP (In-System Programming)' acquisition in mobile forensics?

Accepted Answer

Connecting directly to the flash memory chip's test points on the PCB to read raw data

Answer

Extracting data via the carrier network

Answer

An internet-based acquisition using device credentials

Answer

A method for extracting SIM card data

Question 6

What is a Faraday bag and why is it used during mobile device seizure?

Accepted Answer

A shielded bag that blocks radio signals to prevent remote wipes, new data writes, or passcode changes

Answer

An anti-static bag to prevent electrostatic discharge

Answer

A tamper-evident evidence bag

Answer

A UV-protective bag for preserving latent prints