CHFI Mobile Device Forensics 2 — Questions and Answers
Question 1: Which iOS feature encrypts the file system key with a passcode-derived key, making data inaccessible without the correct passcode?
- Secure Enclave
- Data Protection (Correct answer)
- Touch ID
- Keychain
Correct answer: Data Protection
iOS Data Protection ties file encryption keys to the user's passcode, rendering data unreadable when the device is locked.
Question 2: An investigator finds a deleted SMS on an Android device by examining raw NAND flash blocks. What technique is being used?
- Logical acquisition
- Manual extraction
- Chip-off forensics (Correct answer)
- JTAG extraction
Correct answer: Chip-off forensics
Chip-off forensics involves physically removing the NAND flash chip and reading its raw contents, allowing recovery of deleted data.
Question 3: Which database format stores the majority of application data, call logs, and messages on both iOS and Android devices?
- XML
- SQLite (Correct answer)
- JSON
- LevelDB
Correct answer: SQLite
SQLite is the primary relational database engine used by mobile operating systems to store structured application data.
Question 4: A forensic examiner wants to extract data from a locked Android device using the JTAG method. What does this technique access?
- Cloud backups only
- SIM card data only
- Raw memory via test access ports (Correct answer)
- Encrypted keystore
Correct answer: Raw memory via test access ports
JTAG accesses the device's memory by connecting to Joint Test Action Group debug ports on the motherboard.
Question 5: What iOS artifact contains a history of locations visited by the device, stored as a SQLite database?
- com.apple.locationd/clients
- consolidated.db (Correct answer)
- CellLocationLocal.db
- significant_locations.db
Correct answer: consolidated.db
Historically, consolidated.db stored location history on iOS devices and became a major forensic artifact.
Question 6: Which Android acquisition method provides the most complete data extraction, including deleted files, but requires the device to be rooted?
- ADB backup
- Logical extraction via USB
- Physical acquisition (Correct answer)
- Cloud sync extraction
Correct answer: Physical acquisition
Physical acquisition creates a bit-for-bit image of the storage medium and can recover deleted data, but typically requires root access.
Question 7: During mobile forensics, an examiner discovers a file named 'mmssms.db' on an Android device. What does this file contain?
- Installed application list
- SMS and MMS message history (Correct answer)
- Multimedia gallery metadata
- Mobile payment records
Correct answer: SMS and MMS message history
The mmssms.db SQLite database stores SMS and MMS messages on Android devices.
CHFI Mobile Device Forensics 2
Which iOS feature encrypts the file system key with a passcode-derived key, making data inaccessible without the correct passcode?