CHFI Mobile Device Forensics 3 — Questions and Answers
Question 1: What is the primary purpose of a Faraday bag in mobile device forensics?
- Prevent battery discharge
- Block electromagnetic signals to prevent remote wipe (Correct answer)
- Maintain chain of custody documentation
- Store extracted data securely
Correct answer: Block electromagnetic signals to prevent remote wipe
A Faraday bag shields the device from cellular, Wi-Fi, and Bluetooth signals, preventing remote wipe commands from reaching it.
Question 2: Which Apple forensic artifact records the last known location of an iOS device along with timestamps and accuracy radius?
- routined database (Correct answer)
- Maps history cache
- Location.suggestd
- Cache.sqlite in Maps
Correct answer: routined database
The routined daemon manages significant location tracking on iOS, storing data in its associated database files.
Question 3: An investigator needs to bypass Android's FRP (Factory Reset Protection) lock during forensic examination. What is the primary challenge FRP presents?
- Encrypted bootloader
- Requires original Google account credentials to activate after reset (Correct answer)
- Hardware-fused encryption keys
- OEM-specific bypass needed
Correct answer: Requires original Google account credentials to activate after reset
FRP requires the original Google account credentials to be entered after a factory reset, preventing unauthorized activation of the device.
Question 4: Which iOS file system partition contains the user's data, installed apps, and forensically relevant artifacts?
- /System
- /private/var (Correct answer)
- /Applications
- /usr/lib
Correct answer: /private/var
The /private/var partition (user data partition) on iOS contains all user-generated data, app data, and forensic artifacts.
Question 5: What Android debug feature, when enabled, allows forensic tools to communicate with a device via USB for data extraction?
- Developer Mode
- Safe Mode
- ADB (Android Debug Bridge) (Correct answer)
- USB Tethering
Correct answer: ADB (Android Debug Bridge)
ADB (Android Debug Bridge) is a command-line tool that enables communication between a computer and an Android device for extraction and analysis.
Question 6: During iOS forensic analysis, the examiner finds a 'Snapshots' folder inside an app's container. What does this typically contain?
- Encrypted app credentials
- Screenshots taken by iOS for the app switcher (Correct answer)
- App crash logs
- Temporary cache files
Correct answer: Screenshots taken by iOS for the app switcher
iOS captures screenshots of app content when the user presses the Home button; these snapshots are stored for the app switcher display.
Question 7: Which protocol allows forensic examiners to extract data from older iPhones by exploiting vulnerabilities in the DFU mode?
- checkm8 bootrom exploit (Correct answer)
- GrayKey hardware method
- Cellebrite UFED premium
- iCloud backup extraction
Correct answer: checkm8 bootrom exploit
The checkm8 bootrom exploit targets an unpatchable vulnerability in Apple's A5-A11 chips, enabling DFU-mode extraction of encrypted data.
CHFI Mobile Device Forensics 3
What is the primary purpose of a Faraday bag in mobile device forensics?