CHFI Mobile Device Forensics 4 — Questions and Answers
Question 1: A CHFI investigator examines a suspect's iPhone backup stored on a Windows PC. Where are iTunes backups located by default?
- C:\Users\<user>\AppData\Roaming\Apple Computer\MobileSync\Backup (Correct answer)
- C:\Program Files\iTunes\Backups
- C:\Users\<user>\Documents\iPhone Backups
- C:\ProgramData\Apple\Backups
Correct answer: C:\Users\<user>\AppData\Roaming\Apple Computer\MobileSync\Backup
iTunes stores iPhone backups in the AppData\Roaming\Apple Computer\MobileSync\Backup directory on Windows.
Question 2: What is the significance of the 'Manifest.db' file found in an iOS iTunes backup?
- Contains the device UDID and encryption flag
- Maps hashed backup file names to original file paths and metadata (Correct answer)
- Stores the backup encryption key
- Lists installed applications and versions
Correct answer: Maps hashed backup file names to original file paths and metadata
Manifest.db is a SQLite database that maps the SHA1-hashed filenames in the backup to their original file paths and metadata.
Question 3: Which mobile forensic artifact on Android contains a record of all installed packages, their permissions, and signing certificates?
- /data/system/packages.xml (Correct answer)
- /data/app/manifest.xml
- /system/packages.list
- /data/system/appops.xml
Correct answer: /data/system/packages.xml
The packages.xml file in /data/system/ maintains a registry of all installed applications, their permissions, and signing certificates.
Question 4: During a CHFI investigation, an examiner recovers WhatsApp messages from an Android device. Where is the WhatsApp message database typically stored?
- /data/data/com.whatsapp/databases/msgstore.db (Correct answer)
- /sdcard/WhatsApp/Databases/msgstore.db
- /data/app/com.whatsapp/messages.db
- /system/media/whatsapp/chat.db
Correct answer: /data/data/com.whatsapp/databases/msgstore.db
WhatsApp stores its message database at /data/data/com.whatsapp/databases/msgstore.db, which requires root access to read directly.
Question 5: What does the term 'acquisition window' refer to in mobile device forensics?
- The time frame during which data extraction tools are licensed
- The period between seizure and examination during which volatile data may be lost (Correct answer)
- The screen resolution settings used during screenshot capture
- The time limit for court-admissible evidence submission
Correct answer: The period between seizure and examination during which volatile data may be lost
The acquisition window is the critical period between device seizure and examination during which volatile evidence (RAM, cache) can degrade or be lost.
Question 6: An investigator finds evidence of a deleted photo on an iPhone. Which iOS artifact might still contain thumbnail references to the deleted image?
- Photos.sqlite (Correct answer)
- DCIM folder metadata
- iCloud Photo Library cache
- Spotlight index
Correct answer: Photos.sqlite
Photos.sqlite maintains the iOS photo library database, which may retain records and thumbnail references even after an image is deleted.
Question 7: Which standard governs the handling of digital evidence in mobile forensics to ensure admissibility in US courts?
- ISO/IEC 27037
- NIST SP 800-101 (Correct answer)
- RFC 3227
- SWGDE Best Practices
Correct answer: NIST SP 800-101
NIST Special Publication 800-101 'Guidelines on Mobile Device Forensics' provides the standard framework for mobile evidence handling in the US.
CHFI Mobile Device Forensics 4
A CHFI investigator examines a suspect's iPhone backup stored on a Windows PC.
Where are iTunes backups located by default?