Practice Question · CISSP Study Group

Practice Question

You are collecting evidence from a mobile device during a forensic investigation. The device is encrypted and the user is unavailable to provide the password. What is the BEST approach?

a) Attempt to crack the encryption using readily available tools.

b) Consult with a legal professional to obtain a warrant or other legal authorization to compel the user to provide the password or explore other legal options for accessing the data.

c) Erase the device and restore it to factory settings to prevent further access to the encrypted data.

d) Return the device to the user, as there is no legal way to access the encrypted data without the password.

8 comments