ACI Mobile Device Forensics 1 — Questions and Answers
Question 1: What is the first step when handling a mobile device at a crime scene to preserve evidence integrity?
- Power off the device immediately to stop any running processes
- Place the device in a Faraday bag to prevent wireless network connectivity (Correct answer)
- Take a photograph of the device as found before touching it
- Remove the SIM card for separate analysis
Correct answer: Place the device in a Faraday bag to prevent wireless network connectivity
Placing the device in a Faraday bag blocks all wireless signals (cellular, Wi-Fi, Bluetooth) and prevents remote wipe commands or data modification before acquisition.
Question 2: Which type of mobile device acquisition extracts raw binary data directly from the device's flash memory, including deleted files and unallocated space?
- Logical acquisition
- File system acquisition
- Physical acquisition (Correct answer)
- Manual acquisition
Correct answer: Physical acquisition
Physical acquisition performs a bit-for-bit image of the device's entire storage, capturing deleted data, unallocated space, and slack space for the most complete evidence.
Question 3: What does JTAG stand for in the context of mobile device forensics?
- Joint Technical Advisory Group
- Joint Test Action Group (Correct answer)
- Junction Transfer Analysis Gateway
- Joint Technology Assessment Grid
Correct answer: Joint Test Action Group
JTAG (Joint Test Action Group) is an industry standard originally designed for circuit board testing, used in forensics to access device memory through hardware test access ports.
Question 4: Which file system is primarily used by Apple iOS devices since iOS 10.3 for storing user data?
- NTFS
- FAT32
- APFS (Correct answer)
- ext4
Correct answer: APFS
Apple File System (APFS) replaced HFS+ as the primary iOS file system starting with iOS 10.3, offering improved encryption, cloning, and space sharing capabilities.
Question 5: What is the primary forensic purpose of using a Faraday bag during mobile device evidence collection?
- To prevent static electricity damage to the device
- To isolate the device from all wireless signals (Correct answer)
- To maintain a documented chain of custody
- To prevent physical damage during transport
Correct answer: To isolate the device from all wireless signals
A Faraday bag provides electromagnetic shielding that blocks all wireless signals including cellular, Wi-Fi, Bluetooth, and GPS, preventing remote wipe commands from reaching the device.
Question 6: Which acquisition method for Android devices uses a developer tool built into the Android SDK and requires USB debugging to be enabled?
- JTAG extraction
- Chip-off extraction
- ADB (Android Debug Bridge) acquisition (Correct answer)
- iCloud backup extraction
Correct answer: ADB (Android Debug Bridge) acquisition
ADB (Android Debug Bridge) is an Android SDK developer tool that enables logical acquisition of Android device data when USB debugging is enabled on the target device.
Question 7: Which AccessData tool is specifically designed for mobile device data parsing and analysis, including iOS iTunes backups?
- FTK Registry Viewer
- FTK PRTK (Password Recovery Toolkit)
- FTK Mobile Phone Examiner Plus (MPE+) (Correct answer)
- FTK Imager
Correct answer: FTK Mobile Phone Examiner Plus (MPE+)
FTK Mobile Phone Examiner Plus (MPE+) is AccessData's dedicated mobile forensics tool designed to acquire and analyze data from iOS and Android devices, including iTunes backups.
ACI Mobile Device Forensics 1
What is the first step when handling a mobile device at a crime scene to preserve evidence integrity?