Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25

- Free Preparation Discussions

GIAC GASF Exam - Topic 6 Question 68 Discussion

Actual exam question for GIAC's GASF exam

Question #: 68
Topic #: 6

[All GASF Questions]

The device pictured below is in Download Mode to attempt a physical acquisition.

What can be ascertained by viewing the Android boot screen below?

AThe Android is not rooted

BNo ROM changes have ever occurred on this device

CThe Original/Factory ROM is booting

DThe Original ROM was at one time modified

Show Suggested Answer

Suggested Answer: C

https://www.digitalforensics.com/blog/physical-acquisition-of-a-locked-android-device/

by Royal at May 13, 2026, 08:25 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Nickolas

2 days ago

I recall that if the device is in Download Mode, it doesn't necessarily confirm if it's rooted or not. I think option A could be misleading.

upvoted 0 times

...

Johnna

7 days ago

I’m a bit confused. Does the presence of Download Mode mean the original ROM is still intact? I thought it could indicate modifications too.

upvoted 0 times

...

Galen

12 days ago

I think I came across a similar question where we had to determine if a device was modified based on its boot screen. I feel like option D might be the right choice here.

upvoted 0 times

...

Theresia

2 months ago

I remember studying that Download Mode indicates the device is ready for flashing, but I'm not sure how that relates to rooting.

upvoted 0 times

...