ACI Mobile Device Forensics 2 — Questions and Answers
Question 1: What is a logical acquisition of a mobile device?
- Extracting raw binary data directly from flash memory chips
- Copying accessible files and folders using the device's operating system APIs (Correct answer)
- Physically removing the storage chip and reading it directly
- Accessing device memory through JTAG test access ports
Correct answer: Copying accessible files and folders using the device's operating system APIs
Logical acquisition copies accessible files using the device's own file system APIs, making it the least invasive method but unable to recover deleted data or access unallocated space.
Question 2: Which database format is used by both iOS and Android applications to store structured data such as messages, contacts, and call logs locally on the device?
- MySQL
- Oracle DB
- SQLite (Correct answer)
- PostgreSQL
Correct answer: SQLite
SQLite is the standard lightweight, serverless database format used by both iOS and Android for local app data storage, making it a critical artifact type in mobile forensics.
Question 3: What is the IMEI number's primary value in a mobile device forensic investigation?
- To encrypt device communications and protect user data
- To uniquely identify a specific mobile device's hardware globally (Correct answer)
- To track the device's real-time GPS location
- To identify which SIM card is currently installed in the device
Correct answer: To uniquely identify a specific mobile device's hardware globally
The International Mobile Equipment Identity (IMEI) is a unique 15-digit hardware identifier assigned to each mobile device, enabling investigators to link a specific physical device to network activity records.
Question 4: Which SQLite database on an iPhone stores both SMS and iMessage communications?
- AddressBook.sqlitedb
- sms.db (Correct answer)
- voicemail.db
- notes.sqlite
Correct answer: sms.db
The sms.db SQLite database located at /var/mobile/Library/SMS/ on iOS devices stores all SMS text messages and iMessages, including sender/receiver data and timestamps.
Question 5: What is 'chip-off' forensics in the context of mobile device examination?
- Removing and analyzing the SIM card separately
- Physically removing the flash memory chip from the circuit board and reading it directly (Correct answer)
- Disabling the device's security encryption chip via software
- Extracting data through the device's charging port connection
Correct answer: Physically removing the flash memory chip from the circuit board and reading it directly
Chip-off forensics involves physically desoldering the flash memory chip from the device's circuit board and reading it with specialized equipment, bypassing all OS-level security but risking physical damage.
Question 6: Where are deleted files typically recoverable from when performing a physical acquisition of a mobile device?
- In the device's recycle bin or trash folder
- In the unallocated space of the device's flash storage (Correct answer)
- In cloud backup files synced automatically
- Only in the device's volatile RAM
Correct answer: In the unallocated space of the device's flash storage
Deleted files on mobile devices often persist in unallocated storage space until the OS overwrites them with new data, making physical acquisition essential for deleted data recovery.
Question 7: Which iOS artifact stores a record of the device's historical location data using cell tower and Wi-Fi triangulation?
- com.apple.Maps.plist
- consolidated.db (location database) (Correct answer)
- SystemVersion.plist
- Keychain-2.db
Correct answer: consolidated.db (location database)
The consolidated.db database (and later cache.db) stores cell tower and Wi-Fi access point location history on iOS devices, providing a record of the device's movements over time.
ACI Mobile Device Forensics 2
What is a logical acquisition of a mobile device?