GASF Mobile Evidence Acquisition Methods

Question 1

What is the order of acquisition methods from least to most data yield on mobile devices?

Accepted Answer

Logical < File System < Physical, with Cloud varying by provider

Answer

Logical acquisition yields the least data, file system acquisition yields more, and physical (raw chip) acquisition yields the most, while cloud data volume depends on the specific provider and user.

Question 2

What is JTAG acquisition and when is it used in mobile forensics?

Accepted Answer

A hardware technique using test access points on the PCB to read memory via the device's debug interface

Answer

JTAG uses the device's built-in debug interface (test access points on the PCB) to communicate directly with the processor and read memory contents.

Question 3

Which principle requires that forensic examiners work on a copy of evidence rather than the original device storage?

Accepted Answer

Working copy principle (forensic imaging)

Answer

The forensic imaging principle requires creating a verified bit-for-bit copy of the original media and working only from that copy to preserve the original evidence.

Question 4

What hashing algorithm is most commonly used to verify the integrity of a mobile forensic image?

Accepted Answer

SHA-256

Answer

SHA-256 is the most commonly recommended hash algorithm for forensic verification due to its collision resistance and acceptance in legal proceedings.

Question 5

What is 'ISP (In-System Programming)' acquisition in mobile forensics?

Accepted Answer

Connecting directly to the flash memory chip's test points on the PCB to read raw data

Answer

ISP acquisition connects to the flash memory chip's programming interface (test pads on the PCB) to read raw storage data without removing the chip.

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF - Giac Advanced Smartphone Forensics Practice Test

GASF Mobile Evidence Acquisition Methods