Practice Test GeeksCDFI - Certified Digital Forensics Investigator Practice Test
← All CDFI Flashcard Decks

CDFI Mobile Device & Cloud Forensics Flashcards

6 cards from real CDFI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 6 CDFI Mobile Device & Cloud Forensics flashcards as text

  1. Which extraction method provides the most complete data from a modern locked Android device during a CDFI investigation?

    Answer: Physical extraction using chip-off or JTAG methods

    Physical extraction methods like chip-off or JTAG access raw flash memory, bypassing device locks to obtain the most complete dataset including deleted data.

  2. What does 'logical extraction' of a mobile device produce in a forensic investigation?

    Answer: An export of accessible files and databases through the device's OS interface

    Logical extraction interfaces with the device's operating system to export accessible files, contacts, messages, and app data without bypassing security controls.

  3. Which forensic tool is widely recognized for mobile device acquisition and analysis in the US law enforcement community?

    Answer: Cellebrite UFED

    Cellebrite UFED (Universal Forensic Extraction Device) is the industry-leading tool used by US law enforcement for mobile device data extraction and analysis.

  4. When acquiring cloud data during a CDFI investigation, what is the legally required mechanism to compel a US cloud provider to disclose customer data?

    Answer: A valid legal process such as a court order, warrant, or subpoena

    Under the Stored Communications Act, US providers must comply with valid court orders, warrants, or subpoenas before disclosing subscriber content or non-content data.

  5. What type of data is typically found in an iOS device's 'iTunes backup' that is valuable for forensic analysis?

    Answer: Contacts, messages, app data, photos, and call history

    An iTunes/Finder backup contains contacts, SMS/iMessages, photos, call history, app data, and device settings, making it a rich forensic artifact even without physical access.

  6. What is 'faraday shielding' used for when handling a suspect's mobile device at the scene?

    Answer: Blocking wireless signals to prevent remote wipe or data alteration

    A Faraday bag or cage blocks cellular, Wi-Fi, and Bluetooth signals, preventing the device from receiving remote wipe commands or new data that could alter evidence.