nerdexam
GIAC

GCFA · Question #221

Which of the following log files are used to collect evidences before taking the bit-stream image of the BlackBerry? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is A. Roam and Radio C. Radio status D. Transmit/Receive. BlackBerry forensic log files - Roam and Radio, Radio status, and Transmit/Receive - are collected as evidence before creating a bit-stream image because they capture device radio and network activity.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Which of the following log files are used to collect evidences before taking the bit-stream image of the BlackBerry? Each correct answer represents a complete solution. Choose all that apply.

Options

  • ARoam and Radio
  • Buser history
  • CRadio status
  • DTransmit/Receive

How the community answered

(23 responses)
  • A
    78% (18)
  • B
    22% (5)

Why each option

BlackBerry forensic log files - Roam and Radio, Radio status, and Transmit/Receive - are collected as evidence before creating a bit-stream image because they capture device radio and network activity.

ARoam and RadioCorrect

Roam and Radio logs record roaming behavior and radio network activity on the BlackBerry, providing forensic evidence of carrier connections and mobility patterns that could be lost or altered if not collected before imaging.

Buser history

User history is a general browsing and application usage record that is typically preserved within the bit-stream image itself and is not one of the specific BlackBerry radio/network log categories identified for pre-imaging evidence collection.

CRadio statusCorrect

Radio status logs capture the current state of the radio interface including signal strength and network registration details, which are volatile and must be preserved as evidence prior to imaging.

DTransmit/ReceiveCorrect

Transmit/Receive logs document data packets sent and received by the device, serving as direct forensic evidence of communications activity that supports investigations before the bit-stream image is taken.

Concept tested: BlackBerry forensic pre-imaging log evidence collection

Topics

#BlackBerry forensics#mobile log files#evidence collection#bit-stream imaging

Community Discussion

No community discussion yet for this question.

Full GCFA Practice