CHFI - Computer Hacking Forensic Investigator Mobile Device Forensics Questions and Answers — Questions and Answers
Question 1: An investigator is presented with a powered-on, unlocked Android device and needs to perform a quick data extraction in the field. To minimize changes to the device and rapidly capture user data like contacts, call logs, and SMS messages, which acquisition method should be prioritized?
- Chip-off acquisition
- Physical acquisition
- Logical acquisition (Correct answer)
- JTAG acquisition
Correct answer: Logical acquisition
Logical acquisition is the fastest and least invasive method, ideal for a preliminary field examination of an unlocked device. It copies files and data accessible through the standard user interface, which includes contacts, call logs, and messages. Physical, JTAG, and Chip-off methods are much more invasive, time-consuming, and complex, typically reserved for laboratory analysis.
Question 2: A forensic examiner is analyzing a full file system extraction of an iPhone. In which of the following SQLite database files would the examiner most likely find a comprehensive record of SMS, MMS, and iMessage communications?
- /private/var/mobile/Library/SMS/sms.db (Correct answer)
- /private/var/mobile/Library/Accounts/Accounts3.sqlite
- /private/var/root/Library/Caches/locationd/consolidated.db
- /private/var/mobile/Library/CoreDuet/Knowledge/knowledgeC.db
Correct answer: /private/var/mobile/Library/SMS/sms.db
The sms.db file, located at /private/var/mobile/Library/SMS/, is the primary SQLite database on iOS devices for storing all SMS, MMS, and iMessage data. The other paths are for account information (Accounts3.sqlite), historical location data (consolidated.db), and general user activity logs (knowledgeC.db).
Question 3: A forensic investigator is attempting to extract data from a severely damaged smartphone that will not power on. The device's motherboard is cracked, making JTAG and ISP methods impossible. Which of the following is the most appropriate, albeit destructive, technique to attempt data recovery?
- Logical acquisition
- File system acquisition
- Manual acquisition
- Chip-off (Correct answer)
Correct answer: Chip-off
Chip-off is an advanced, invasive forensic technique where the flash memory chip is physically de-soldered from the circuit board and read with a specialized device. It is considered a last resort when the device is non-functional and other methods like JTAG are not viable due to physical damage. The other methods require a functioning or at least partially functioning device.
Question 4: Which of the following unique identifiers is permanently associated with the mobile device's hardware and is used by cellular networks to identify and potentially block a stolen or unauthorized device?
- IMSI (International Mobile Subscriber Identity)
- IMEI (International Mobile Equipment Identity) (Correct answer)
- ICCID (Integrated Circuit Card Identifier)
- MSISDN (Mobile Station International Subscriber Directory Number)
Correct answer: IMEI (International Mobile Equipment Identity)
The IMEI (International Mobile Equipment Identity) is a unique 15-digit number that identifies the physical mobile device hardware. Networks use the IMEI to track and block devices. In contrast, the IMSI is tied to the subscriber's SIM card, the ICCID is the SIM card's serial number, and the MSISDN is the user's phone number.
Question 5: A suspect claims to have only stored a few contacts on their SIM card and that the phone's internal memory is irrelevant. Why is this statement often misleading in the context of modern smartphone forensics?
- Modern smartphones primarily store contacts, call logs, and extensive message histories on internal flash memory, not the SIM card. (Correct answer)
- SIM cards are read-only and cannot be used to store any user-generated data like contacts.
- All data saved to a SIM card is automatically and permanently deleted after 30 days.
- The IMEI number of the phone is stored on the SIM card, linking all activity to the subscriber.
Correct answer: Modern smartphones primarily store contacts, call logs, and extensive message histories on internal flash memory, not the SIM card.
While older feature phones had limited capacity to store contacts and SMS messages on a SIM card, modern smartphones use their large internal flash memory to store vast amounts of data, including comprehensive contact details, call logs, and entire message conversations. The SIM card's role is primarily to store subscriber identity information.
Question 6: The security model of a particular mobile operating system is often described as a 'walled garden,' where the manufacturer controls the hardware, firmware, operating system, and application distribution. This model presents a significant challenge for forensic examiners trying to gain deep file system access. Which operating system is most famously associated with this model?
- Symbian
- Android
- iOS (Correct answer)
- Windows Phone
Correct answer: iOS
Apple's iOS is famously described as a 'walled garden' because Apple maintains tight control over every aspect of the ecosystem. This closed model, while enhancing security for users, creates major hurdles for forensic investigators, as it restricts access to the full file system and requires specialized tools and methods to bypass security measures.
CHFI - Computer Hacking Forensic Investigator Mobile Device Forensics Questions and Answers
An investigator is presented with a powered-on, unlocked Android device and needs to perform a quick data extraction in the field.
To minimize changes to the device and rapidly capture user data like contacts, call logs, and SMS messages, which acquisition method should be prioritized?