Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

GIAC GASF Exam - Topic 7 Question 65 Discussion

When dealing with mobile devices and flash memory, and the fact that data in memory constantly changeseven when the device is simply powered on. It is best practice to:
B) Document those changes that were made to the device during the forensic process
A) Only acquire from devices in an OFF state
C) Always use a write-blocker when dealing with mobile devices
D) Always remove the battery from a device before acquisition

GIAC GASF Exam - Topic 7 Question 65 Discussion

Actual exam question for GIAC's GASF exam
Question #: 65
Topic #: 7
[All GASF Questions]

When dealing with mobile devices and flash memory, and the fact that data in memory constantly changes

even when the device is simply powered on. It is best practice to:

Show Suggested Answer Hide Answer
Suggested Answer: B

mobile device because they communicate using modern protocols such as AT commands and others.

Because of these factors, the goal in forensic becomes to make as little change as possible, and to document

those changes that were made to the device during the forensic process.


by Pete at Apr 04, 2026, 06:08 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Brandon
1 month ago
A seems risky. Acquiring from an OFF state might miss important data.
upvoted 0 times
...
Raymon
1 month ago
I feel like C is important too. Write-blockers are essential for integrity.
upvoted 0 times
...
Dino
1 month ago
I think B is the best choice. Documenting changes is crucial.
upvoted 0 times
...
Gennie
2 months ago
Not sure about B, how do you document changes accurately?
upvoted 0 times
...
Lakeesha
2 months ago
Wait, removing the battery? Isn’t that risky?
upvoted 0 times
...
Detra
2 months ago
C is a must! Write-blockers are essential for integrity.
upvoted 0 times
...
Arlie
4 months ago
I think A is too extreme, you can still get data from a powered-on device.
upvoted 0 times
...
Maryln
4 months ago
B is definitely the way to go!
upvoted 0 times
...
Pansy
4 months ago
I’m leaning towards option A, but I’m not confident if acquiring from an OFF state is always feasible with mobile devices.
upvoted 0 times
...
Hyun
5 months ago
I feel like removing the battery might not be the best option since it could lead to data loss.
upvoted 0 times
...
My
5 months ago
I think we practiced a question similar to this, and I recall that documenting changes is crucial during the forensic process.
upvoted 0 times
...
Edna
5 months ago
I remember discussing the importance of write-blockers in class, but I'm not entirely sure if they're always necessary for mobile devices.
upvoted 0 times
...

Save Cancel