CHFI Mobile Device Forensics 5 — Questions and Answers
Question 1: What is the primary forensic challenge posed by Apple's 'Secure Enclave Processor' (SEP) in modern iPhones?
- It stores encryption keys that cannot be extracted even by Apple (Correct answer)
- It encrypts iCloud backups differently than device backups
- It requires specialized JTAG probes to access
- It wipes data after 10 failed passcode attempts at the hardware level
Correct answer: It stores encryption keys that cannot be extracted even by Apple
The SEP stores cryptographic keys in hardware that are never exposed to the main OS, making brute-force attacks the only viable method.
Question 2: A forensic examiner is analyzing an Android device and finds the file '/data/system/gesture.key'. What does this file contain?
- Biometric fingerprint data
- A SHA1 hash of the screen unlock pattern (Correct answer)
- Encrypted PIN storage
- Gesture-based app launch shortcuts
Correct answer: A SHA1 hash of the screen unlock pattern
gesture.key contains an unsalted SHA1 hash of the Android unlock pattern, which can potentially be cracked offline.
Question 3: Which mobile forensic technique involves using specialized hardware clips to read flash memory without desoldering the chip?
- ISP (In-System Programming) (Correct answer)
- JTAG extraction
- Logical extraction
- EDL (Emergency Download Mode)
Correct answer: ISP (In-System Programming)
ISP (In-System Programming) uses test pads on the PCB to read flash memory directly without removing the chip.
Question 4: During iOS forensic analysis, what is the forensic significance of the 'KnowledgeC.db' database?
- Stores Safari browsing history
- Records app usage, device wake/sleep events, and location data with timestamps (Correct answer)
- Contains Siri conversational data
- Maintains Apple Pay transaction records
Correct answer: Records app usage, device wake/sleep events, and location data with timestamps
KnowledgeC.db is an iOS Core Data store that tracks app usage patterns, device states, and user activities with precise timestamps.
Question 5: What does 'GrayKey' primarily enable in mobile forensics investigations?
- Remote iCloud backup extraction
- Physical extraction and passcode bypass on iPhones (Correct answer)
- Android pattern lock cracking via GPU
- SIM card cloning for call interception
Correct answer: Physical extraction and passcode bypass on iPhones
GrayKey is a law enforcement tool developed by Grayshift that enables passcode brute-forcing and physical data extraction from iPhones.
Question 6: An examiner recovers a mobile device from a crime scene still powered on. According to best practices, what should be done first?
- Power off the device immediately to freeze its state
- Place it in a Faraday bag to isolate it from networks while keeping it powered (Correct answer)
- Connect it to a forensic workstation for immediate acquisition
- Remove the SIM card to preserve call records
Correct answer: Place it in a Faraday bag to isolate it from networks while keeping it powered
Keeping the device powered on in a Faraday bag preserves volatile data while preventing remote wipe commands from reaching it.
Question 7: Which artifact on Android devices records the history of Wi-Fi networks the device has connected to, including SSID and BSSID information?
- /data/misc/wifi/WifiConfigStore.xml (Correct answer)
- /system/etc/wifi/networks.conf
- /data/wifi/saved_networks.db
- /system/wpa_supplicant.conf
Correct answer: /data/misc/wifi/WifiConfigStore.xml
WifiConfigStore.xml (on newer Android versions) stores saved Wi-Fi network profiles including SSID, BSSID, and authentication details.
CHFI Mobile Device Forensics 5
What is the primary forensic challenge posed by Apple's 'Secure Enclave Processor' (SEP) in modern iPhones?