New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

GIAC GASF Exam - Topic 6 Question 53 Discussion

Actual exam question for GIAC's GASF exam
Question #: 53
Topic #: 6
[All GASF Questions]

The device pictured below is in Download Mode to attempt a physical acquisition.

What can be ascertained by viewing the Android boot screen below?

Show Suggested Answer Hide Answer
Suggested Answer: C

https://www.digitalforensics.com/blog/physical-acquisition-of-a-locked-android-device/

by Willard at May 04, 2025, 01:09 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Ariel
2 months ago
I think it's safe to say the factory ROM is booting.
upvoted 0 times
...
Natalie
2 months ago
Wait, how can we be sure no ROM changes happened?
upvoted 0 times
...
Jenise
3 months ago
Definitely not rooted, that's a good sign!
upvoted 0 times
...
Serina
3 months ago
Really? I thought any modification could still show up here.
upvoted 0 times
...
German
3 months ago
Looks like the device is in a safe state for acquisition.
upvoted 0 times
...
Ronny
3 months ago
I'm leaning towards option D because I remember something about modified ROMs being a common issue in physical acquisitions, but I could be mixing it up with another topic.
upvoted 0 times
...
Lamar
4 months ago
I feel like I read somewhere that if the Original/Factory ROM is booting, it usually means the device hasn't been tampered with, but I can't recall the specifics.
upvoted 0 times
...
Eladia
4 months ago
I think I came across a similar question about ROM changes in practice, and it mentioned that if the device is in Download Mode, it might suggest no modifications have been made.
upvoted 0 times
...
Jacinta
4 months ago
I remember studying that the boot screen can indicate if the device is rooted or not, but I'm not entirely sure how to tell just from this image.
upvoted 0 times
...
Virgie
4 months ago
I think the key here is to look for any signs of custom ROM or modifications on the boot screen. If I don't see anything obvious, I'll go with the option that seems most likely based on the information given.
upvoted 0 times
...
Jospeh
4 months ago
Okay, the boot screen shows the device is in Download Mode, so that's a good starting point. I'll need to consider the different options and see which one best fits the information provided.
upvoted 0 times
...
Margarita
5 months ago
Hmm, the boot screen doesn't seem to give a clear indication of whether the device has been rooted or had its ROM modified. I'll have to think this through carefully.
upvoted 0 times
...
Suzan
5 months ago
This looks like a tricky question. I'll need to carefully examine the boot screen to see if I can spot any clues about the device's history.
upvoted 0 times
...
Noble
9 months ago
Ah, the age-old question - to root or not to root? That is the dilemma. But hey, who needs a rooted device when you've got the sheer power of the original ROM, am I right? This baby's gonna run like a dream, I can feel it! *insert a cheesy superhero pose*
upvoted 0 times
...
Rosendo
9 months ago
Hmm, the boot screen's telling us a lot, but I can't help but wonder - what's the story behind this device? Did it survive a drop or two? Has it seen the light of day more than a vampire? The plot thickens, my friends!
upvoted 0 times
Chandra
9 months ago
D) The Original ROM was at one time modified
upvoted 0 times
...
Emeline
9 months ago
C) The Original/Factory ROM is booting
upvoted 0 times
...
Luke
9 months ago
B) No ROM changes have ever occurred on this device
upvoted 0 times
...
Amos
9 months ago
A) The Android is not rooted
upvoted 0 times
...
...
Yen
10 months ago
Ah, the age-old question - to root or not to root? That is the dilemma. But hey, who needs a rooted device when you've got the sheer power of the original ROM, am I right? This baby's gonna run like a dream, I can feel it!
upvoted 0 times
Merrilee
8 months ago
C) The Original/Factory ROM is booting
upvoted 0 times
...
Fabiola
9 months ago
B) No ROM changes have ever occurred on this device
upvoted 0 times
...
Daren
9 months ago
A) The Android is not rooted
upvoted 0 times
...
...
Laurel
10 months ago
I'm not sure, but I think it's either C or D. The screen doesn't show any signs of rooting or ROM changes.
upvoted 0 times
...
Van
10 months ago
Well, well, looks like we've got a device in its original glory! But you know what they say, 'don't judge a book by its cover.' I bet there's a whole world of customization and tinkering we haven't even scratched the surface of. Let's keep our eyes peeled, shall we?
upvoted 0 times
Nathan
8 months ago
C) The Original/Factory ROM is booting
upvoted 0 times
...
Franchesca
9 months ago
B) No ROM changes have ever occurred on this device
upvoted 0 times
...
Silvana
9 months ago
A) The Android is not rooted
upvoted 0 times
...
...
Lea
10 months ago
I believe the answer could also be D) The Original ROM was at one time modified.
upvoted 0 times
...
Sherrell
10 months ago
I agree with Tamesha, it looks like the original ROM is booting.
upvoted 0 times
...
Tamesha
10 months ago
I think the answer is C) The Original/Factory ROM is booting.
upvoted 0 times
...
Elroy
10 months ago
Option C sounds right, the stock ROM is definitely booting up. But I wonder if the device is still in pristine condition, or if there have been any sneaky modifications under the hood. Hmm, guess we'll have to dig a little deeper to find out!
upvoted 0 times
Annelle
9 months ago
C) The Original/Factory ROM is booting
upvoted 0 times
...
Floyd
9 months ago
B) No ROM changes have ever occurred on this device
upvoted 0 times
...
Rima
10 months ago
A) The Android is not rooted
upvoted 0 times
...
...

Save Cancel