MENU
When dealing with mobile devices and flash memory, and the fact that data in memory constantly changes
even when the device is simply powered on. It is best practice to:
Suggested Answer: B
Get Premium GASF Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
mobile device because they communicate using modern protocols such as AT commands and others.
Because of these factors, the goal in forensic becomes to make as little change as possible, and to document
those changes that were made to the device during the forensic process.
12 comments · newest first
BR
Brandon
3 months ago
A seems risky. Acquiring from an OFF state might miss important data.
RA
Raymon
3 months ago
I feel like C is important too. Write-blockers are essential for integrity.
DI
Dino
3 months ago
I think B is the best choice. Documenting changes is crucial.
GE
Gennie
3 months ago
Not sure about B, how do you document changes accurately?
LA
Lakeesha
3 months ago
Wait, removing the battery? Isn’t that risky?
DE
Detra
4 months ago
C is a must! Write-blockers are essential for integrity.
AR
Arlie
5 months ago
I think A is too extreme, you can still get data from a powered-on device.
MA
Maryln
5 months ago
B is definitely the way to go!
PA
Pansy
6 months ago
I’m leaning towards option A, but I’m not confident if acquiring from an OFF state is always feasible with mobile devices.
HY
Hyun
6 months ago
I feel like removing the battery might not be the best option since it could lead to data loss.
MY
My
6 months ago
I think we practiced a question similar to this, and I recall that documenting changes is crucial during the forensic process.
ED
Edna
6 months ago
I remember discussing the importance of write-blockers in class, but I'm not entirely sure if they're always necessary for mobile devices.