nerdexam
CompTIA

SY0-501 · Question #172

Which of the following best describes the initial processing phase used in mobile device forensics?

The correct answer is D. The phone and storage cards should be examined as a complete unit after examining the. The initial processing phase in mobile device forensics emphasizes preserving the device's state and data integrity by treating it, including its storage components, as a cohesive unit.

Submitted by wei.xz· Mar 4, 2026Security operations

Question

Which of the following best describes the initial processing phase used in mobile device forensics?

Options

  • AThe phone should be powered down and the battery removed to preserve the state of data on
  • BThe removable data storage cards should be processed first to prevent data alteration when
  • CThe mobile device should be examined first, then removable storage and lastly the phone without
  • DThe phone and storage cards should be examined as a complete unit after examining the

How the community answered

(33 responses)
  • A
    9% (3)
  • B
    3% (1)
  • C
    12% (4)
  • D
    76% (25)

Why each option

The initial processing phase in mobile device forensics emphasizes preserving the device's state and data integrity by treating it, including its storage components, as a cohesive unit.

AThe phone should be powered down and the battery removed to preserve the state of data on

Powering down and removing the battery can lead to the loss of volatile data (e.g., RAM contents, active processes) crucial for forensic analysis, which contradicts best practices for preserving the device's 'live' state.

BThe removable data storage cards should be processed first to prevent data alteration when

Processing removable data storage cards separately and first can disrupt the overall evidence picture and potentially miss critical interactions or alter the device's state if not handled within the context of the complete system.

CThe mobile device should be examined first, then removable storage and lastly the phone without

Examining components in a fragmented sequence (device, then storage, then phone without) risks altering the device's state, missing interdependencies, and compromising the integrity of the evidence by not treating the system holistically during initial preservation.

DThe phone and storage cards should be examined as a complete unit after examining theCorrect

In mobile device forensics, the phone and its storage cards are initially examined as a complete unit to ensure the holistic preservation of evidence. This approach maintains the contextual relationships between internal and external data, preventing accidental alteration and providing a comprehensive view of the device's state as found.

Concept tested: Mobile device forensic evidence preservation and initial handling

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-101r1.pdf

Topics

#mobile forensics#digital forensics#evidence preservation#forensic investigation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice