GIAC Exam GASF Topic 6 Question 53 Discussion

Actual exam question for GIAC's GASF exam

Question #: 53
Topic #: 6

[All GASF Questions]

The device pictured below is in Download Mode to attempt a physical acquisition.

What can be ascertained by viewing the Android boot screen below?

AThe Android is not rooted

BNo ROM changes have ever occurred on this device

CThe Original/Factory ROM is booting

DThe Original ROM was at one time modified

Show Suggested Answer

Suggested Answer: C

https://www.digitalforensics.com/blog/physical-acquisition-of-a-locked-android-device/

by Willard at May 04, 2025, 01:09 AM

Limited Time Offer

25%

Off

Get Premium GASF Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Noble

1 months ago

Ah, the age-old question - to root or not to root? That is the dilemma. But hey, who needs a rooted device when you've got the sheer power of the original ROM, am I right? This baby's gonna run like a dream, I can feel it! *insert a cheesy superhero pose*

upvoted 0 times

...

Rosendo

1 months ago

Hmm, the boot screen's telling us a lot, but I can't help but wonder - what's the story behind this device? Did it survive a drop or two? Has it seen the light of day more than a vampire? The plot thickens, my friends!

upvoted 0 times

Chandra

12 days ago

D) The Original ROM was at one time modified

upvoted 0 times

...

Emeline

15 days ago

C) The Original/Factory ROM is booting

upvoted 0 times

...

Luke

16 days ago

B) No ROM changes have ever occurred on this device

upvoted 0 times

...

Amos

18 days ago

A) The Android is not rooted

upvoted 0 times

...

Yen

1 months ago

upvoted 0 times

Merrilee

5 days ago

C) The Original/Factory ROM is booting

upvoted 0 times

...

Fabiola

14 days ago

B) No ROM changes have ever occurred on this device

upvoted 0 times

...

Daren

17 days ago

A) The Android is not rooted

upvoted 0 times

...

Laurel

1 months ago

I'm not sure, but I think it's either C or D. The screen doesn't show any signs of rooting or ROM changes.

upvoted 0 times

...

Van

1 months ago

Well, well, looks like we've got a device in its original glory! But you know what they say, 'don't judge a book by its cover.' I bet there's a whole world of customization and tinkering we haven't even scratched the surface of. Let's keep our eyes peeled, shall we?

upvoted 0 times

Nathan

2 days ago

C) The Original/Factory ROM is booting

upvoted 0 times

...

Franchesca

17 days ago

B) No ROM changes have ever occurred on this device

upvoted 0 times

...

Silvana

29 days ago

A) The Android is not rooted

upvoted 0 times

...

Lea

2 months ago

I believe the answer could also be D) The Original ROM was at one time modified.

upvoted 0 times

...

Sherrell

2 months ago

I agree with Tamesha, it looks like the original ROM is booting.

upvoted 0 times

...

Tamesha

2 months ago

I think the answer is C) The Original/Factory ROM is booting.

upvoted 0 times

...

Elroy

2 months ago

Option C sounds right, the stock ROM is definitely booting up. But I wonder if the device is still in pristine condition, or if there have been any sneaky modifications under the hood. Hmm, guess we'll have to dig a little deeper to find out!

upvoted 0 times

Annelle

12 days ago

C) The Original/Factory ROM is booting

upvoted 0 times

...

Floyd

15 days ago

B) No ROM changes have ever occurred on this device

upvoted 0 times

...

Rima

1 months ago

A) The Android is not rooted

upvoted 0 times

...