Examkin

Question

Difficulty: MediumDigital Forensics and Chain of Custody

An incident response analyst seizes a powered-on smartphone that is suspected of being used in an active data exfiltration incident. To prevent remote wipe commands or external data modification over cellular or Wi-Fi networks while transporting the physical evidence to the forensics laboratory, which of the following is the most appropriate action to take?

  1. Enclose the mobile device inside a shielded Faraday bag to isolate it from external wireless signals.Answer
  2. B
    Unlock the device screen and manually enable Airplane Mode before transport.
  3. C
    Initiate an immediate remote cloud backup using suspect credentials prior to power-off.
  4. D
    Re-encrypt the internal flash controller with a temporary public key to ensure non-repudiation during transport.

Answer

Enclose the mobile device inside a shielded Faraday bag to isolate it from external wireless signals.
Enclosing the mobile device in a Faraday bag creates a Faraday cage that blocks all incoming and outgoing radio frequency (RF) signals, such as cellular, Wi-Fi, and Bluetooth. This prevents attackers from issuing remote wipe commands or altering data over the network while the investigator transports the device for evidence collection.

Step-by-Step Solution

1
Identify the threat vector facing mobile device evidence during transit.
Powered-on mobile devices remain connected to cellular, Wi-Fi, or Bluetooth networks and are vulnerable to remote wipe commands or automated data syncs.
Over-the-air signals can modify or destroy evidentiary data before forensic acquisition.
2
Evaluate evidence preservation controls against forensic standards.
Using a Faraday enclosure blocks all electromagnetic radio frequency signals without altering the device's volatile RAM state or system logs.
Radio frequency isolation guarantees physical evidence preservation without user interface interaction.

Key Concept

Radio Frequency (RF) Signal Isolation in Digital Forensics
Rate this question

Topics

Digital Forensics and Chain of Custody

More questions from this topic