GIAC GASF Exam - Topic 7 Question 65 Discussion

Actual exam question for GIAC's GASF exam

Question #: 65
Topic #: 7

[All GASF Questions]

When dealing with mobile devices and flash memory, and the fact that data in memory constantly changes

even when the device is simply powered on. It is best practice to:

AOnly acquire from devices in an OFF state

BDocument those changes that were made to the device during the forensic process

CAlways use a write-blocker when dealing with mobile devices

DAlways remove the battery from a device before acquisition

Show Suggested Answer

Suggested Answer: B

mobile device because they communicate using modern protocols such as AT commands and others.

Because of these factors, the goal in forensic becomes to make as little change as possible, and to document

those changes that were made to the device during the forensic process.

by Pete at Apr 04, 2026, 06:08 AM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

4 days ago

I feel like removing the battery might not be the best option since it could lead to data loss.

upvoted 0 times

...

9 days ago

I think we practiced a question similar to this, and I recall that documenting changes is crucial during the forensic process.

upvoted 0 times

...

14 days ago

I remember discussing the importance of write-blockers in class, but I'm not entirely sure if they're always necessary for mobile devices.

upvoted 0 times

...