Mobile Device Forensics Flashcards
7 cards from real ACI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Mobile Device Forensics flashcards as text
What is a logical acquisition of a mobile device?
Answer: Copying accessible files and folders using the device's operating system APIs
Logical acquisition copies accessible files using the device's own file system APIs, making it the least invasive method but unable to recover deleted data or access unallocated space.
Which database format is used by both iOS and Android applications to store structured data such as messages, contacts, and call logs locally on the device?
Answer: SQLite
SQLite is the standard lightweight, serverless database format used by both iOS and Android for local app data storage, making it a critical artifact type in mobile forensics.
What is the IMEI number's primary value in a mobile device forensic investigation?
Answer: To uniquely identify a specific mobile device's hardware globally
The International Mobile Equipment Identity (IMEI) is a unique 15-digit hardware identifier assigned to each mobile device, enabling investigators to link a specific physical device to network activity records.
Which SQLite database on an iPhone stores both SMS and iMessage communications?
Answer: sms.db
The sms.db SQLite database located at /var/mobile/Library/SMS/ on iOS devices stores all SMS text messages and iMessages, including sender/receiver data and timestamps.
What is 'chip-off' forensics in the context of mobile device examination?
Answer: Physically removing the flash memory chip from the circuit board and reading it directly
Chip-off forensics involves physically desoldering the flash memory chip from the device's circuit board and reading it with specialized equipment, bypassing all OS-level security but risking physical damage.
Where are deleted files typically recoverable from when performing a physical acquisition of a mobile device?
Answer: In the unallocated space of the device's flash storage
Deleted files on mobile devices often persist in unallocated storage space until the OS overwrites them with new data, making physical acquisition essential for deleted data recovery.
Which iOS artifact stores a record of the device's historical location data using cell tower and Wi-Fi triangulation?
Answer: consolidated.db (location database)
The consolidated.db database (and later cache.db) stores cell tower and Wi-Fi access point location history on iOS devices, providing a record of the device's movements over time.